The vulnerability is a stored cross‑site scripting flaw in the WordPress Form Maker by 10Web plugin. User supplied form data is rendered on web pages without proper neutralization, allowing attackers to embed malicious scripts that persist in the form records. These scripts execute in the browsers of any visitor who loads a page containing the affected form.

WordPress sites that have the Form Maker by 10Web plugin version 1.15.50 or earlier are vulnerable. All releases from the first public deployment up to and including 1.15.50 lack the necessary input sanitization and are at risk.

With a CVSS score of 7.1 the flaw is classified as High severity. The EPSS score is not available, leaving the probability of exploitation uncertain, yet the lack of mitigation mechanisms makes the attack likely on sites that expose the form to visitors. It is not listed in the CISA KEV catalog, suggesting no confirmed exploitation in the wild, but stored XSS remains a powerful and common threat vector.