Description
The Form Maker by 10Web WordPress plugin before 1.15.51 does not consistently escape user-submitted field values before rendering them on its submissions admin page, allowing unauthenticated users to store a payload that executes as arbitrary web scripts in the session of an administrator who views the submissions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Form Maker by 10Web | < 1.15.51 | 1.15.51 |
References
- https://wpscan.com/vulnerability/d992e80b-5c69-44ea-8dcc-7c8d2768115f/ exploit vdb-entry technical-description