{"id":"CVE-2026-105413","title":"Form Maker by 10Web < 1.15.51 - Unauthenticated Stored XSS via Submission Field Values","summary":"The Form Maker by 10Web  WordPress plugin before 1.15.51 does not consistently escape user-submitted field values before rendering them on its submissions admin page, allowing unauthenticated users to store a payload that executes as arb…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvssSource":"adp","cwe":["CWE-79"],"product":"Form Maker by 10Web","affected":["form_maker_by_10web < 1.15.51"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-11-04T14:07:22.175182Z"},"published":"2026-11-04","updated":"2026-11-04","sourceUpdated":"2026-11-04T14:18:23.119Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-105413","references":[{"url":"https://wpscan.com/vulnerability/d992e80b-5c69-44ea-8dcc-7c8d2768115f/"}],"tags":["cve.org"],"epss":0.00267,"epssPercentile":0.18929,"ingestedAt":"2026-11-05T21:36:00.377Z","slug":"CVE-2026-105413","body":"## Overview\n\nThe Form Maker by 10Web  WordPress plugin before 1.15.51 does not consistently escape user-submitted field values before rendering them on its submissions admin page, allowing unauthenticated users to store a payload that executes as arbitrary web scripts in the session of an administrator who views the submissions.\n\n## Affected\n\n- `form_maker_by_10web < 1.15.51`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}