CVE-2026-118067

The Form Maker by 10Web WordPress plugin (versions up to and including 1.15.50 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping involving the wdform__element and disabled_fields parameters. Unauthenticated attackers can i...

CVE-2026-118067 Form Maker by 10Web <= 1.15.50 - Unauthenticated Stored Cross-Site Scripting via disabled_fields Parameter

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wdformelement payload + disabledfields pivot' parameter in all versions up to, and including, 1.15.50 due to insufficient input sanitization and...