Medium severity5.5NVD Advisory· Published Sep 26, 2024· Updated Jun 17, 2026
CVE-2024-8633
CVE-2024-8633
Description
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.15.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: <=1.15.27
- 10web/Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builderv5Range: 0
Patches
Vulnerability mechanics
References
3- plugins.trac.wordpress.org/changeset/3156791/nvdPatch
- www.wordfence.com/threat-intel/vulnerabilities/id/2b32cc12-c8d5-40b8-9510-42699beec581nvdThird Party Advisory
- wordpress.org/plugins/form-maker/nvdProduct
News mentions
0No linked articles in our index yet.