CVE-2026-103998 in Form Maker Plugin
Summary
by MITRE • 10/10/2026
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'inputs (array key)' parameter in all versions up to, and including, 1.15.48 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/10/2026
The Form Maker plugin by 10Web is a widely utilized WordPress extension designed to facilitate the creation of mobile-friendly, drag-and-drop contact forms with extensive customization options. While these features enhance site functionality and user engagement for legitimate administrators, they also introduce significant attack surfaces if input handling mechanisms are not rigorously enforced. The vulnerability identified in versions up through 1.15.48 stems from a fundamental failure to properly sanitize and escape data within the inputs array key parameter. This specific flaw allows unauthenticated attackers to inject malicious client-side scripts into web pages served by the vulnerable application, leading directly to reflected cross-site scripting conditions that compromise user security without requiring prior authentication credentials.
From a technical perspective, the core issue lies in how the plugin processes form input data during rendering or processing phases. When an attacker crafts a specially constructed URL containing malicious JavaScript payloads within the inputs array key parameter, the server-side code fails to validate this input against expected formats or escape special characters before embedding it into the HTML response. Consequently, when a victim user clicks on such a link, their browser interprets the injected script as part of the legitimate page content and executes it in the context of the vulnerable site. This execution environment grants the attacker access to session cookies, local storage data, and other sensitive information associated with the authenticated user's current session, effectively bypassing same-origin policy protections that are designed to isolate web applications from one another.
The operational impact of this vulnerability is severe due to its unauthenticated nature and reflected delivery mechanism. Unlike stored cross-site scripting where malicious code persists on a server, reflected XSS requires social engineering tactics such as phishing emails or deceptive links to trigger the exploit against specific targets. However, once triggered, the attacker can perform actions on behalf of the victim, including stealing session tokens to hijack administrative accounts, defacing website content, redirecting users to malicious sites hosting malware, or harvesting sensitive personal information submitted through forms. This capability undermines trust in the WordPress ecosystem and exposes organizations using this plugin to significant data breach risks and compliance violations related to user privacy protection standards like GDPR or CCPA.
In terms of industry classification frameworks, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific vector involves reflected input handling where the application echoes back unsanitized data directly into the HTML output stream without applying appropriate encoding functions such as htmlspecialchars or wp_kses in PHP environments. Furthermore, from a tactical perspective within the MITRE ATT&CK framework for enterprise security, this exploit maps to T1059 Command and Scripting Interpreter specifically under JavaScript sub-techniques used during initial access campaigns where attackers leverage web application flaws to execute arbitrary code on victim systems through browser-based execution contexts rather than direct system-level command injection.
To mitigate the immediate risks associated with this vulnerability, administrators must prioritize updating the Form Maker plugin to version 1.15.49 or later which addresses these sanitization gaps by implementing robust input validation and output encoding procedures for all user-supplied data including array keys used in form processing logic. Until an update is applied, temporary mitigations include restricting access to WordPress admin areas via IP whitelisting if feasible, deploying Web Application Firewalls configured to detect and block common XSS payload patterns within URL parameters, and educating users about the dangers of clicking suspicious links from unknown sources. Long-term remediation strategies should involve adopting secure coding practices that enforce strict type checking for all form inputs and utilizing content security policies headers to restrict script execution origins thereby reducing the blast radius even if a successful injection attempt occurs.