CVE-2026-103998

Name of the Vulnerable Software and Affected Versions Form Maker by 10Web versions prior to 1.15.49

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting (XSS), a technique where malicious scripts are injected into a web page and executed in the victim's browser. This occurs via the inputs (array key) parameter, enabling the execution of arbitrary web scripts if a user is tricked into clicking a malicious link.

Recommendations Update the plugin to a version newer than 1.15.48.