CVE-2026-1058

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

The Form Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via hidden field values in all versions up to, and including, 1.15.35. This is due to insufficient output escaping when displaying hidden field values in the admin submissions list. The plugin uses html_entity_decode() on user-supplied hidden field values without subsequent escaping before output, which converts HTML entity-encoded payloads back into executable JavaScript. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in the admin submissions view that will execute whenever an administrator accesses the submissions list.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
10web	Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder	<= 1.15.35

References

Timeline

Published: Feb 3, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-105809.8The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover CVE-2026-1058003.7i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacke CVE-2026-1058018.4openapi-python-client generates Python clients from OpenAPI documents. Prior to 0.29.1, the generator does not safely neutralize malicious O CVE-2026-1058045.7Payload is a free and open source headless content management system. Payload versions from 3.0.0 before 3.90.0 and canary versions from 4.0 CVE-2026-1058056.9Payload is a free and open source headless content management system. In versions before 3.88.0 and canary versions before 4.0.0-canary.27, CVE-2026-1058068.6Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authen CVE-2026-1058077.3A vulnerability was found in SourceCodester Simple Student Information System 1.0. This affects an unknown part of the file searchquery.php.CVE-2026-1058083.5A vulnerability was determined in SourceCodester Simple Student Information System 1.0. This vulnerability affects the function clean of the CVE-2026-1058094.3A vulnerability was identified in SourceCodester Simple Student Information System 1.0. This issue affects some unknown processing of the fi CVE-2026-105816.3A flaw has been found in DedeCMS 5.7.88. Affected by this vulnerability is the function base64_decode of the file /plus/download.php?open=1.CVE-2026-1058108.5Tapo C320WS V2.0 contains an authenticated stack-based buffer overflow in the local onboarding Wi-Fi configuration path. An authenticated at CVE-2026-1058116.5Authorization bypass through a user-controlled key in the optional Amazon Q Business Lambda hook sample ( q-business-lambda-hook https://git