CVE-2026-85645 in Form Maker Plugin
Summary
by MITRE • 09/10/2026
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the bulk_action parameter in all versions up to, and including, 1.15.46 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/10/2026
The Form Maker plugin by 10Web is a widely utilized WordPress extension designed to facilitate the creation of mobile-friendly, drag-and-drop contact forms. While these features enhance usability for site administrators and end-users, they also introduce potential attack surfaces if input validation mechanisms are not rigorously implemented. In versions up to and including 1.15.46, a critical security flaw exists within the plugin's handling of bulk actions. Specifically, the vulnerability resides in the processing of the bulk_action parameter, which is used to execute various administrative or user-facing operations related to form management. The core technical deficiency lies in insufficient input sanitization and output escaping when this parameter is processed by the server-side script. This lack of proper validation allows malicious actors to inject arbitrary web scripts directly into the application's response without requiring authentication credentials.
This vulnerability classifies as a Reflected Cross-Site Scripting, commonly referred to as XSS Type 1 or non-persistent XSS. The attack vector relies on social engineering tactics where an unauthenticated attacker crafts a specially constructed URL containing malicious JavaScript code within the bulk_action parameter. When a legitimate user with administrative privileges clicks this link while logged into their WordPress dashboard, the browser executes the injected script in the context of the vulnerable site. Because the payload is reflected back to the user via the HTTP response rather than stored in the database, it does not persist on the server but can still cause immediate harm during the session. This aligns with CWE-79, which describes improper neutralization of input during web page generation, and maps directly to MITRE ATT&CK technique T1059.007, indicating command execution through browser-based scripting environments like JavaScript.
The operational impact of this vulnerability is significant for any WordPress site running the affected version of Form Maker. An attacker can exploit this flaw to steal session cookies, hijack administrative sessions, or perform actions on behalf of the victim user without their knowledge. For instance, an attacker could redirect the administrator to a phishing page, extract sensitive data from local storage, or even modify form configurations if the injected script has sufficient privileges within the DOM. Since WordPress plugins often have elevated permissions relative to standard users, compromising an admin account through reflected XSS can lead to full site compromise, including defacement, malware distribution, and unauthorized access to backend databases. The unauthenticated nature of this exploit means that no prior login or credential theft is necessary to initiate the attack sequence, lowering the barrier for entry significantly.
To mitigate this vulnerability, immediate action is required by updating the Form Maker plugin to version 1.15.47 or later, where these input sanitization and output escaping issues have been addressed. Developers should ensure that all user-supplied inputs are strictly validated against expected formats using allowlists rather than blocklists whenever possible. Furthermore, implementing Content Security Policy headers can help mitigate the impact of any remaining XSS vulnerabilities by restricting the sources from which scripts can be loaded or executed. For site administrators who cannot update immediately due to compatibility constraints, deploying a Web Application Firewall that detects and blocks common XSS payloads in URL parameters provides an additional layer of defense. Regular security audits and penetration testing should also be conducted to identify similar flaws in other plugins or custom code within the WordPress environment.