CVE-2024-6130: The Form Maker by 10Web WordPress plugin before 1.15.26 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting

medium Affects form-maker (WordPress plugin). Feed 2026.10.29.4, updated 2026-10-29; published 2024-07-01; advisory modified 2026-06-17.

The Form Maker by 10Web WordPress plugin before 1.15.26 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting

Package: form-maker (WordPress plugin) WordPress
Affected versions: <1.15.26
Fixed in: 1.15.26
Severity: medium CVSS 4.8
Exploitation: not on CISA KEV · EPSS 0% (38.3th percentile)
Published: 2024-07-01
Source: nvd

References

CWE-79

NVD record form-maker (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# PHP projects (recommended)
composer require --dev phpwarden/phpwarden
# then
vendor/bin/phpwarden wordpress /var/www/html

# or, without Composer
pipx install phpwarden   &&   phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2019-10866 critical In the Form Maker plugin before 1.13.3 for WordPress, it's possible to achieve SQL injecti same package: form-maker (WordPress plugin)
CVE-2018-10504 high The WebDorado "Form Maker by WD" plugin before 1.12.24 for WordPress allows CSV injection. same package: form-maker (WordPress plugin)
CVE-2023-4666 critical The Form Maker by 10Web WordPress plugin before 1.15.20 does not validate signatures when same package: form-maker (WordPress plugin)
CVE-2022-3300 high The Form Maker by 10Web WordPress plugin before 1.15.6 does not properly sanitise and esca same package: form-maker (WordPress plugin)
CVE-2019-11590 high The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin same package: form-maker (WordPress plugin)
CVE-2021-24526 medium The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugi same package: form-maker (WordPress plugin)