The Form Maker by 10Web plugin for WordPress contains a stored cross‑site scripting flaw. A Matrix field (Text Box input type) accepts content that is passed through sanitize_text_field, which removes tags but not inconsistent quotes, and the field data is rendered in the admin Submissions view without escaping. This allows an unauthenticated attacker to submit a form that contains malicious JavaScript, which will execute automatically in the browser of any administrator who later views the submission. The impact is remote script execution in an admin session, enabling credential theft, session hijacking and potential site defacement.

The vulnerability affects all releases of the Form Maker by 10Web – Mobile‑Friendly Drag & Drop Contact Form Builder for WordPress up to and including version 1.15.40. WordPress sites that have not upgraded past this version are susceptible.

The flaw has a CVSS score of 7.2, indicating high severity. Because it does not require authentication to inject the payload, and any administrative viewer of a malicious submission will trigger execution, the risk is significant even though EPSS data is unavailable and it is not listed in CISA’s KEV catalog. The low barrier to exploitation means that attackers can readily take advantage of this weakness if the plugin remains outdated.