Form Maker by 10Web WordPress plugin stored script injection flaw
A WordPress contact form plugin can let attackers hack your site.
Summary
A flaw in how the Form Maker by 10Web plugin handles hidden input fields lets attackers plant malicious scripts in pages. All versions up to and including 1.15.50 are affected, and the script runs only after an administrator clicks a link in the Submissions screen.
Affected when
- An administrator opens the Submissions screen and clicks Show-on-Map on the poisoned entry
What to do
Check that the plugin runs a version newer than 1.15.50 and read the vendor's advisory. No fixed version is named in the sources.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen