Form Maker by 10Web < 1.15.32 - Admin+ Stored XSS

Vulnerability

The Form Maker by 10Web plugin for WordPress before version 1.15.32 does not sanitize and escape some of its settings. This allows high privilege users, such as administrators, to inject stored cross-site scripting (XSS) payloads. The vulnerability is especially critical in multisite configurations where the unfiltered_html capability is disallowed [1].

Exploitation

An attacker with admin-level access can inject malicious scripts into plugin settings. No user interaction is required from other users; the XSS payload executes when the settings page is viewed by other admins or when the injected script is rendered elsewhere [1].

Impact

Successful exploitation leads to stored XSS, allowing the attacker to execute arbitrary JavaScript in the context of other admin users' sessions. This can result in session hijacking, defacement, or further privilege escalation within the WordPress environment [1].

Mitigation

The issue is fixed in version 1.15.32. Users should update the plugin immediately. No known workarounds have been disclosed. The vulnerability has been publicly disclosed on WPScan [1].