WordPress Form Maker Plugin Hit by Stored XSS

The National Vulnerability Database (NVD) recently detailed a significant security flaw, CVE-2026-4388, affecting the Form Maker by 10Web plugin for WordPress. This vulnerability, a Stored Cross-Site Scripting (XSS) issue, impacts all versions up to and including 1.15.40.

According to the NVD, the root cause lies in insufficient input sanitization within the Matrix field’s Text Box input type during form submissions. Specifically, while sanitize_text_field strips HTML tags, it fails to handle quotes properly. Compounding this, there’s a lack of output escaping when submission data is rendered in the administrator’s Submissions view. This oversight creates an avenue for unauthenticated attackers to inject arbitrary JavaScript code through a crafted form submission. The malicious script then executes in the browser of any administrator who views the submission details, potentially leading to session hijacking, data theft, or further compromise of the WordPress site.