CVE-2026-1065 describes a Stored Cross-Site Scripting (XSS) vulnerability in the Form Maker by 10Web plugin for WordPress, affecting all versions up to and including 1.15.35. This flaw stems from the plugin's default allowance of SVG file uploads combined with inadequate substring-based extension validation, enabling unauthenticated attackers to upload malicious SVG files. Successful exploitation allows JavaScript code execution when viewed by administrators or site visitors, given the attacker can submit a form with file upload capabilities. The vulnerability carries a CVSS score of 7.2 (HIGH), indicating a significant risk. Its attack vector is network-based with low attack complexity, requiring no privileges or user interaction for the initial upload, and leading to potential impacts on confidentiality and integrity. The "S:C" scope change signifies that the vulnerability in one component can affect resources beyond its security scope. Currently, there is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, which is typical for a large percentage of reported vulnerabilities.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| 10web | Form Maker By 10Web – Mobile-Friendly Drag & Drop Contact Form Builder | >= 0, <= 1.15.35CNA affecteddefault unaffected |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.