The Form Maker plugin for WordPress is vulnerable to stored cross-site scripting via hidden field values. Because the plugin applies html_entity_decode() to user-supplied hidden fields without escaping the result, an attacker can inject JavaScript that will be executed whenever an administrator views the submissions list. This leads to arbitrary code execution in the context of the admin user, allowing credential theft, defacement, data exfiltration and other malicious actions.

All versions of the 10Web Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin up to and including 1.15.35 are affected. The plugin is a WordPress add‑on that is publicly available on the WordPress plugin repository.

The vulnerability scores a CVSS of 7.1 and an EPSS of <1 %. It is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers can exploit it by submitting a form with a malicious payload in a hidden field, a task that does not require authentication. When an admin later views that submission, the injected script runs with the admin’s privileges. The low EPSS indicates that, so far, no widespread exploitation has been observed, but the impact is high if utilized.