CVE-2026-4388

The Form Maker by 10Web WordPress plugin versions up to 1.15.40 contains a Stored Cross-Site Scripting vulnerability in the Matrix field component that allows unauthenticated attackers to inject malicious JavaScript through form submissions. The vulnerability stems from inadequate input sanitization using only sanitize_text_field, which fails to remove quotes, combined with missing output escaping when administrators view submission details in the backend. The vulnerability carries a CVSS 3.1 score of 7.2 (HIGH) with a network-based attack vector requiring low complexity and no privileges. Its impact includes low confidentiality and integrity compromise affecting not just the vulnerable site but potentially the confidentiality and integrity of connected systems, as reflected by the changed scope metric. The EPSS score of 0.0009 indicates this is not currently among the most frequently exploited vulnerabilities in the wild. There is no evidence of active exploitation at this time, as the vulnerability is not listed on the Known Exploited Vulnerabilities catalog and carries an inactive status on vulnerability tracking lists. No public exploit code appears to be readily available, and community attention remains moderate given the moderate FAUCET Risk Score of 46.0 out of 100. Organizations using this plugin should prioritize updating to a patched version to prevent potential stored XSS attacks targeting their administrators.