CVE-2026-96813

HighCVSS 7.2/10Last modified Oct 3, 2026

Description

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields in all versions up to, and including, 1.15.47 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Oct 1, 2026
Last modified
Oct 3, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-968147.1Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 5.6.7 versions.CVE-2026-968157.2Custom role Privilege Escalation in Vitepos <= 3.5.0 versions.CVE-2026-968167.1Unauthenticated Cross Site Scripting (XSS) in Trusted Shops Easy Integration for WooCommerce <= 2.0.6 versions.CVE-2026-968178.2Subscriber Broken Access Control in MakeCommerce for WooCommerce <= 4.1.0 versions.CVE-2026-968187.5Unauthenticated Broken Access Control in WP Express Checkout (Accept PayPal Payments) <= 2.4.9 versions.CVE-2026-968197.1Subscriber Cross Site Scripting (XSS) in oik <= 4.15.4 versions.CVE-2026-968207.1Subscriber Cross Site Scripting (XSS) in Awesome Support <= 6.3.9 versions.CVE-2026-968216.3Subscriber Privilege Escalation in FluentBoards <= 2.0.12 versions.CVE-2026-968229.3Unauthenticated SQL Injection in Books Gallery <= 4.8.3 versions.CVE-2026-968237.5Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce <= 5.120.0 versions.CVE-2026-968246.8Editor Arbitrary File Deletion in Template Kit – Import <= 1.0.16 versions.CVE-2026-968254.2Subscriber Bypass Vulnerability in All In One WP Security & Firewall <= 5.4.8 versions.
CVE-2026-96813: High severity, CVSS 7.2 | Vulnix