CVE-2024-10265 in Form Maker Plugin
Summary
by MITRE • 11/10/2024
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.15.30. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 02/28/2025
The vulnerability identified as CVE-2024-10265 affects the Form Maker by 10Web WordPress plugin, specifically targeting versions up to and including 1.15.30. This plugin serves as a mobile-friendly drag and drop contact form builder that allows website administrators to create interactive forms without requiring technical coding knowledge. The issue stems from improper handling of URL parameters within the plugin's codebase, creating a security gap that could be exploited by malicious actors seeking to manipulate user sessions or execute unauthorized code on victim machines.
The technical flaw manifests in the plugin's use of the add_query_arg function without proper escaping mechanisms when processing URL parameters. This function is designed to add query arguments to URLs but fails to sanitize the input data before incorporating it into the final URL structure. When user-supplied data enters the application through query parameters and is subsequently processed through add_query_arg without appropriate HTML escaping, it creates an environment where malicious payloads can be injected and executed in the context of a victim's browser session. This represents a classic reflected cross-site scripting vulnerability where the malicious script is reflected off the web server and executed in the victim's browser.
The operational impact of this vulnerability extends beyond simple data theft or session hijacking. Attackers can leverage this weakness to perform various malicious activities including but not limited to cookie theft, session manipulation, and redirection to malicious sites. The vulnerability is particularly dangerous because it requires no authentication, making it accessible to anyone who can craft a malicious URL and trick users into clicking on it. This creates a significant risk for website administrators who rely on the plugin for contact form functionality, as any user visiting a specially crafted URL could become a victim of the attack. The reflected nature of the vulnerability means that the malicious payload is not stored on the server but is instead injected into the response by the web application, making it difficult to detect through traditional server-side scanning methods.
The vulnerability aligns with CWE-79, which specifically addresses Cross-Site Scripting flaws in web applications, and maps to several ATT&CK techniques including T1566.001 for Phishing and T1059.001 for Command and Scripting Interpreter. These mappings highlight how this vulnerability can be exploited as part of broader attack chains where initial access is gained through social engineering tactics and then leveraged to execute malicious code. The impact is particularly concerning for WordPress installations as the Form Maker plugin is widely used, increasing the potential attack surface. Organizations should consider this vulnerability as part of their broader security posture assessment, especially in environments where users may be exposed to untrusted links or content.
Mitigation strategies should include immediate patching of the affected plugin to version 1.15.31 or later, which contains the necessary security fixes. Until patching is complete, administrators should implement additional security measures such as input validation and output escaping for all user-supplied data. Network-level protections including web application firewalls and strict URL filtering can help detect and block malicious requests. Additionally, user education regarding the dangers of clicking on untrusted links and maintaining awareness of potential social engineering attacks should be emphasized. Security monitoring should include regular checks for unusual query parameter patterns and automated scanning for reflected XSS vulnerabilities in web applications. The vulnerability demonstrates the critical importance of proper input sanitization and output escaping practices in web development, reinforcing industry best practices outlined in OWASP Top Ten and other security frameworks.