CVE-2026-120512

Name of the Vulnerable Software and Affected Versions The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder versions prior to 1.15.51

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an affected page. Exploitation happens when an administrator opens the Submissions screen and clicks the Show-on-Map link of a poisoned entry, causing the field id value to be echoed unescaped into a JavaScript string within the FormMakerEditCountryinPopup popup. This process bypasses security checks using the administrator's session and the fm ajax nonce embedded in the link. The issue involves the wdform <n> element<id> parameter used in hidden input fields.

Recommendations Update the plugin to a version newer than 1.15.50.