An unauthenticated attacker can upload a malicious SVG file because the plugin allows SVG files in its default allowlist and performs only weak substring checks on the file extension. The uploaded SVG can contain JavaScript that runs when the file is rendered by a browser, affecting anyone who views the file, including administrators and site visitors who submit the form.

Vulnerable versions are all 10Web Form Maker releases up to and including 1.15.35 for WordPress. The product is a mobile-friendly drag-and-drop contact form builder available as a WordPress plugin. The issue resides in the file upload logic within the form handling code of the plugin.

The CVSS score of 7.2 indicates a high likelihood of impactful exploitation. EPSS is less than 1%, suggesting low overall exploitation probability at present, and the vulnerability is not currently listed in CISA's KEV catalog. Exploitation requires no special privileges; an attacker simply submits a form with a crafted SVG file. If the form is accessible to site visitors, the malicious code runs in their browsers and could lead to data theft or session hijacking, while administrators viewing the uploaded file may suffer credential compromise or site control.