CVE-2026-120512

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wdformelement Hidden Input field, name = user-defined, e.g. hiddenprobe' parameter in all versions up to, and including, 1.15.50 due to insufficien...

CVE-2026-120512 Form Maker by 10Web <= 1.15.50 - Unauthenticated Stored Cross-Site Scripting via Hidden Input Field Value

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wdformelement Hidden Input field, name = user-defined, e.g. hiddenprobe' parameter in all versions up to, and including, 1.15.50 due to insufficien...

CVE-2026-120512

The Form Maker by 10Web WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.15.50 . The root cause is insufficient input sanitization and output escaping of the wdform__element parameter (a user-defined hidden input field). Unauthenticated attacke...