Form Maker by 10Web Stored Cross-Site Scripting Vulnerability via SVG File Upload

A stored cross-site scripting vulnerability has been identified in the Form Maker by 10Web plugin for WordPress, affecting all versions through 1.15.35. The issue arises from the plugin's file upload allowlist, which improperly includes SVG files and applies weak substring-based extension validation. This flaw enables unauthenticated attackers to upload malicious SVG files containing JavaScript that executes when the files are viewed by administrators or site visitors, provided they can submit forms.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where uploaded SVG files containing malicious JavaScript are executed when accessed by users with the appropriate permissions.

Remediation

Users are advised to update the Form Maker by 10Web plugin to version 1.15.36 or a newer patched version.