CVE-2024-10265: 10web Form Maker XSS Vulnerability

CVE-2024-10265 Overview

The Form Maker by 10Web plugin for WordPress contains a Reflected Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 1.15.30. The flaw stems from the use of add_query_arg without proper output escaping on URL parameters within the plugin's notice-handling code. Unauthenticated attackers can inject arbitrary web scripts that execute when a user is tricked into clicking a crafted link. Successful exploitation permits session data theft, forced browser actions in the victim's authenticated context, and redirection to attacker-controlled resources. The vulnerability is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session through crafted URLs, enabling account takeover of WordPress administrators.

Affected Products

10Web Form Maker plugin for WordPress, versions up to and including 1.15.30
WordPress sites using the form-maker plugin package
Deployments referencing the vulnerable notices.php code path

Discovery Timeline

2024-11-10 - CVE-2024-10265 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10265

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting (XSS) issue in the WordPress Form Maker plugin developed by 10Web. The affected code path is located in wd/includes/notices.php around line 199, where the plugin builds URLs using the WordPress add_query_arg() function. Because add_query_arg() echoes the current request URI when no URL is explicitly passed, any attacker-controlled query parameters propagate into rendered HTML.

Without esc_url() or comparable output escaping, script payloads placed in URL parameters render directly into administrative notice markup. The rendered payload executes in the browser of the user who follows the link, inheriting that user's WordPress session context.

Root Cause

The root cause is missing output escaping on user-controllable URL data before rendering it in HTML. The plugin invokes add_query_arg and outputs the resulting URL into an attribute or link within a notice element. Trusted output sinks in WordPress require esc_url() for URLs and esc_attr() for attribute contexts. Omitting these encodes the request URL as-is, permitting HTML and JavaScript injection through crafted query strings.

Attack Vector

An unauthenticated attacker crafts a URL to a vulnerable admin endpoint containing script payloads encoded within query parameters. The attacker delivers this URL to an authenticated WordPress user through phishing, social engineering, or malicious embed. When the victim visits the link, the plugin reflects the payload into the response, and the browser executes the attacker's JavaScript under the victim's origin. If the victim holds administrator privileges, the payload can create backdoor accounts, exfiltrate nonces, or modify site content.

The vulnerability requires user interaction and executes in the victim's browser context. See the Wordfence Vulnerability Report and the WordPress Notice Code Review for technical details.

Detection Methods for CVE-2024-10265

Indicators of Compromise

Web server access logs containing WordPress admin URLs with <script>, javascript:, or onerror= payloads in query parameters
Unexpected administrator accounts, plugin installations, or option changes in WordPress following user clicks on external links
Referrer headers showing external inbound traffic to wp-admin pages with unusual query strings
Browser console errors or CSP violation reports originating from Form Maker admin notice pages

Detection Strategies

Inspect HTTP request logs for encoded script payloads (%3Cscript, %22onmouseover) targeting wp-admin paths where Form Maker renders notices
Deploy a Web Application Firewall (WAF) with rulesets that flag reflected XSS patterns against WordPress admin endpoints
Correlate outbound requests from administrator sessions with recent inbound clicks on external referrers to identify session-riding activity

Monitoring Recommendations

Enable WordPress audit logging to track administrator actions, user creation, and plugin/option modifications
Monitor the installed version of form-maker across managed sites and alert when versions at or below 1.15.30 are detected
Configure Content Security Policy (CSP) headers on wp-admin to restrict inline script execution and report violations

How to Mitigate CVE-2024-10265

Immediate Actions Required

Update the Form Maker plugin to a version above 1.15.30 that includes the fix from WordPress Changeset #3183170
Rotate WordPress administrator passwords and invalidate active sessions if suspicious activity is detected
Review recently created users, installed plugins, and modified site options for signs of post-exploitation

Patch Information

The vendor addressed the vulnerability in the changeset published at WordPress Changeset #3183170. Administrators should upgrade via the WordPress plugin updater or download the current release from the WordPress Form Maker Developers Page. Verify the installed version reports higher than 1.15.30 after applying the update.

Workarounds

Deactivate the Form Maker plugin until the patched version is installed if immediate patching is not feasible
Restrict access to wp-admin by IP allowlisting at the reverse proxy or WAF layer
Deploy a WAF rule blocking requests containing script tags or JavaScript URI schemes in query parameters to WordPress admin paths
Enforce a strict Content Security Policy that disallows inline scripts on administrative pages

bash

# Example WAF rule (ModSecurity) blocking reflected XSS payloads on wp-admin
SecRule REQUEST_URI "@beginsWith /wp-admin/" \
  "chain,phase:2,deny,status:403,id:1002651,msg:'Reflected XSS attempt on WordPress admin'"
  SecRule ARGS "@rx (?i)(<script|javascript:|onerror=|onload=)" "t:urlDecodeUni,t:htmlEntityDecode"