Form Maker by 10Web Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the Form Maker by 10Web plugin for WordPress, affecting all versions through 1.15.40. The issue arises in the Matrix field (Text Box input type) of form submissions, where insufficient input sanitization allows unauthenticated attackers to inject arbitrary JavaScript. This injected script executes in the browser of an administrator viewing the submission details, due to missing output escaping in the admin Submissions view.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the submissions, potentially leading to session hijacking or other malicious actions.

Reproduction

To reproduce this vulnerability, submit a form using the Matrix field with a JavaScript payload. Once submitted, an administrator can view the injection in the Submissions details, where the script will execute in their browser.

Remediation

Users are advised to update the Form Maker by 10Web plugin to version 1.15.41 or later.