CVE-2026-4388: 10web Form Maker By 10web – Mobile-Friendly Drag & Drop Contact Form Builder

High severity, CVSS 7.2. EPSS: 0.4% chance of exploitation in the next 30 days.

The Form Maker by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Matrix field (Text Box input type) in form submissions in all versions up to, and including, 1.15.40. This is due to insufficient input sanitization (`sanitize_text_field` strips tags but not quotes) and missing output escaping when rendering submission data in the admin Submissions view. This makes it possible for unauthenticated attackers to inject arbitrary JavaScript through a form submission that executes in the browser of an administrator who views the submission details.

Affected products

• 10web Form Maker By 10web – Mobile-Friendly Drag & Drop Contact Form Builder: up to and including 1.15.40

Published 2026-04-14. Last modified 2026-06-17.