| Plugin Name | Form Maker by 10Web |
|---|---|
| Type of Vulnerability | Cross-Site Scripting (XSS) |
| CVE Number | CVE-2026-1058 |
| Urgency | Medium |
| CVE Publish Date | 2026-02-08 |
| Source URL | CVE-2026-1058 |
Urgent Security Advisory — Unauthenticated Stored XSS in Form Maker by 10Web (≤ 1.15.35)
Summary: A stored, unauthenticated Cross‑Site Scripting (XSS) vulnerability (CVE‑2026‑1058) affects Form Maker by 10Web plugin versions ≤ 1.15.35. The vendor released 1.15.36 to address the issue. This advisory provides detection, mitigation, and remediation steps — plus immediate virtual patching guidance you can apply via a WAF or equivalent edge filter.
Executive summary
On 6 February 2026 a stored XSS vulnerability was disclosed in the Form Maker by 10Web WordPress plugin (CVE‑2026‑1058). Versions up to and including 1.15.35 are affected. The vendor released version 1.15.36 to address the flaw.
- Vulnerability type: Stored Cross‑Site Scripting (XSS)
- Affected versions: ≤ 1.15.35
- Fixed in: 1.15.36
- CVE: CVE‑2026‑1058
- CVSS base score (example): 7.1 (Medium/High depending on context)
- Attack vector: Unauthenticated, stored
- Impact: Session theft, privilege escalation (if payload executes in admin context), arbitrary JavaScript execution, unauthorized actions
Because the vulnerability is unauthenticated and involves stored content, it can be weaponised to affect administrators, content editors, or site visitors depending on rendering context. Treat any production or staging site using Form Maker as high priority for remediation.
How this vulnerability works (technical overview)
The plugin accepted and persisted form-submitted data (including hidden fields) without proper sanitisation/escaping before rendering it in admin or frontend views. When that stored content is displayed unescaped, a JavaScript payload executes in the viewer’s browser.
Typical attack flow:
- Attacker submits a form containing a hidden field value with a JavaScript payload (example shown escaped):
- The plugin stores the payload in the database alongside the submission.
- When an administrator or other user opens the submissions list, preview, or any detail view that renders the stored hidden field value unescaped, the payload executes in the user’s browser context.
- Consequences include session cookie theft, CSRF-style actions executed under admin sessions, persistent malicious content insertion, or pivoting to a full site compromise.
Because no authentication is required to submit the form, an attacker can inject payloads at scale and wait for legitimate viewing to trigger execution.
Realistic exploitation scenarios
- Social engineering: Multiple malicious submissions followed by a targeted phishing message to lure an admin to the submissions list.
- Automated mass attack: Botnets scan for sites with the plugin, enumerate public forms, and inject payloads into hidden fields en masse.
- Public posts: If submissions are displayed publicly (testimonials, reviews), any visitor could trigger the stored payload.
The gravest outcome is payload execution in an admin context — this can enable account takeover, creation of backdoors, or modifications to themes/plugins.
Indicators of compromise (IoCs) to look for
Search your site and database for injected scripts or suspicious content. Start with these places:
- Database fields and plugin tables that store submissions
- wp_posts, wp_postmeta, wp_comments, wp_options for any stored HTML containing
(?i)on\w+\s*=\s*["']?[^"'>]+["']?(event handlers)(?i)javascript:(javascript: URLs)(?i)data:text/html(data URLs)- Encoded patterns:
%3Cscript%3E,\\x3cscript\\x3e,eval\(,document\.cookie,new Image\(
Example search:
SELECT * FROM wp_postmeta WHERE meta_value REGEXP 'How WAF and virtual patching help — practical benefits
Deploying a WAF or equivalent edge filter provides several immediate benefits while you prepare or apply the vendor patch:
- Block exploit traffic that matches known XSS payload patterns.
- Rate-limit and challenge high-volume automated submissions.
- Detect and log attempted exploitation for forensic analysis.
- Provide temporary virtual patching while you update the plugin.
For organisations managing many sites, centralised rule application via a capable edge filter or WAF simplifies coordination of emergency mitigations.
Hardening checklist (actionable summary)
- Update Form Maker to 1.15.36 (or remove the plugin until updated).
- Enable WAF / virtual patching to block known exploit patterns.
- Search database and filesystem for "
- Reset admin passwords and invalidate sessions.
- Restrict access to admin UI and sensitive pages (IP whitelisting where practical).
- Add CAPTCHA and rate limits to form endpoints.
- Implement a CSP to reduce XSS impact.
- Monitor logs and alert on suspicious POSTs and new admin users.
- Use file integrity monitoring to spot unauthorised changes.
- If compromised, follow the incident response checklist (contain, preserve, eradicate, recover, learn).
Example mitigation timeline (recommended)
- Within 1 hour: Enable WAF rule(s), apply rate limiting, and consider maintenance mode if exploitation is suspected.
- Within 4 hours: Update plugin to 1.15.36 or remove plugin; scan DB for obvious payloads.
- Within 24 hours: Rotate admin credentials, invalidate sessions, and search for deeper compromise.
- Within 72 hours: Restore from clean backup if required; re-enable site; continue monitoring.
A short note to developers maintaining integrations with Form Maker
Audit every output path that renders data from Form Maker. Stored XSS is nearly always the result of failing to escape on render. Even after the plugin is patched, integrations that render stored data without escaping remain vulnerable.
Always:
- Use
esc_html(),esc_attr(),esc_url()when printing data. - Validate inputs strictly before saving.
- Use prepared statements and avoid storing unsanitised HTML unless explicitly required and properly whitelisted.
If you lack in-house capability to review code, engage experienced security auditors to perform a targeted XSS review.
Closing thoughts
Unauthenticated, stored XSS vulnerabilities present a high operational risk for WordPress sites: they are easy to weaponise at scale and can be used to achieve administrative takeover. This issue in Form Maker by 10Web (CVE‑2026‑1058) should be treated urgently — update to 1.15.36 now or apply virtual patching and access restrictions while you remediate.
If you require assistance with writing WAF rules, scanning for indicators of compromise, or conducting a post‑remediation review, engage qualified security professionals promptly. Treat any discovery of suspicious scripts as a potential compromise and follow the containment and forensic steps described above.
— Hong Kong Security Expert
