The Form Maker by 10Web plugin contains an improper neutralization of input during web page generation, enabling a stored cross‑site scripting (XSS) flaw. A malicious actor can inject HTML or JavaScript that is later rendered in the browser of any user who views the affected form, potentially leading to session hijacking, defacement, or malicious redirect. The weakness is a classic uncontrolled input – CWE‑79.

WordPress sites that have installed the Form Maker by 10Web plugin version 1.15.33 or earlier. The vulnerability applies to all releases from the first commit through 1.15.33, including any bundled files served by the plugin.

The CVSS score of 5.9 indicates a moderate impact. The EPSS score of less than 1% suggests a low probability of exploitation observed in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attackers would most likely use the plugin's administrative interface to submit malicious input, which the plugin stores and later outputs without encoding. If the site relies on the unfiltered input to enable business processes, compromised users could be exposed to session hijacking, data theft or a malicious redirect. Nonetheless, because the flaw requires injecting payloads that become part of the stored form configuration, the attacker must have access to the plugin's settings or the ability to add content through the form creation interface.