The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress, versions up to 1.15.50, contains a stored cross‑site scripting flaw that allows an unauthenticated attacker to inject malicious script via the "wdform_<field_id>_element<form_id> + disabled_fields<form_id>" parameters. By exploiting a file upload field and disabling its storage row, the attacker can place the payload in an unescaped slot so that it executes in the admin context when an administrator opens the Submissions page, potentially enabling credential theft, site defacement, or further attacks.

All installations of the 10Web Form Maker – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress with a version number of 1.15.50 or earlier. The vulnerability is present in all plugin releases up to and including 1.15.50, regardless of other WordPress components.

The CVSS v3 score is 5.4, indicating moderate risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is achievable through unauthenticated form submissions that include a file upload field, enabling the attacker to inject malicious payloads that execute when an administrator accesses the Submissions page. Because the flaw requires specific form configurations, exploitation is less likely than generic XSS but still achievable if the plugin is deployed with default settings.