CVE-2025-48341: 10Web Form Maker Stored XSS Vulnerability

CVE-2025-48341 Overview

CVE-2025-48341 is a stored Cross-Site Scripting (XSS) vulnerability in the 10Web Form Maker plugin for WordPress. The flaw affects all versions of Form Maker by 10Web up to and including 1.15.33. It stems from improper neutralization of input during web page generation, tracked under [CWE-79].

An authenticated attacker with high privileges can inject persistent JavaScript payloads into the plugin. Those payloads execute in the browser of any user who later views the affected page. The scope change in the CVSS vector indicates the injected script can affect resources beyond the vulnerable component.

Critical Impact
Authenticated attackers can store malicious JavaScript that executes in other users' browsers, enabling session theft, administrative action forgery, and content defacement across the WordPress site.

Affected Products

10Web Form Maker plugin for WordPress
All versions from initial release through 1.15.33
WordPress sites with the plugin installed and active

Discovery Timeline

2025-05-19 - CVE-2025-48341 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48341

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the Form Maker by 10Web WordPress plugin. Stored XSS occurs when user-supplied input is saved to persistent storage and later rendered to other users without adequate output encoding.

Exploitation requires authenticated access with high privileges and user interaction from a victim. Because the attack traverses a scope boundary, injected scripts can affect components outside the vulnerable plugin, including the WordPress administrative interface. Successful exploitation compromises confidentiality, integrity, and availability of user sessions within the affected site.

Root Cause

The root cause is missing or insufficient sanitization of input fields handled by the plugin before those values are rendered in HTML output. The plugin fails to apply context-appropriate escaping functions such as esc_html(), esc_attr(), or wp_kses() when writing stored form or configuration data back to the page. This allows an attacker to persist HTML and JavaScript payloads that later execute in a victim's browser session.

Attack Vector

An attacker with an authenticated, high-privileged account submits a crafted payload through a vulnerable Form Maker input surface. The payload is stored in the WordPress database. When a legitimate user, typically an administrator or editor, loads the page containing that stored data, the browser parses the payload as HTML and executes the embedded script.

The injected code runs under the origin of the WordPress site. Attackers commonly use this position to exfiltrate session cookies, invoke privileged REST or admin-ajax endpoints, create rogue administrator accounts, or pivot into further plugin functionality. See the Patchstack advisory for additional technical context.

Detection Methods for CVE-2025-48341

Indicators of Compromise

Unexpected <script>, <iframe>, or event-handler attributes (for example, onerror, onload) stored in Form Maker database tables
New WordPress administrator accounts created without a corresponding audit trail
Outbound HTTP requests from browser sessions to unfamiliar domains after loading Form Maker pages
Modifications to plugin form definitions or entries that do not correlate with legitimate administrator activity

Detection Strategies

Query WordPress database tables owned by the Form Maker plugin for HTML tags and JavaScript event handlers in stored field values
Review WordPress activity logs for form edits performed by unexpected accounts or from unusual IP addresses
Inspect browser Content Security Policy (CSP) violation reports for script-source violations originating on plugin pages
Correlate authenticated administrative sessions with anomalous outbound network activity

Monitoring Recommendations

Enable a WordPress audit logging plugin to capture creation and modification of forms, users, and roles
Forward web server access logs to a centralized logging platform and alert on repeated POSTs to Form Maker endpoints by high-privileged users
Deploy a Web Application Firewall (WAF) rule set that flags script tags and JavaScript event handlers submitted to plugin endpoints
Monitor for unexpected changes to wp_users, wp_usermeta, and plugin-specific tables

How to Mitigate CVE-2025-48341

Immediate Actions Required

Update the 10Web Form Maker plugin to a version later than 1.15.33 once the vendor publishes a fix
Audit all WordPress accounts with administrator or editor privileges and remove unused accounts
Review existing form definitions and stored entries for injected HTML or JavaScript and remove malicious content
Rotate WordPress administrator passwords and invalidate active sessions if compromise is suspected

Patch Information

A fixed version addressing CVE-2025-48341 should be applied as soon as it is available from 10Web. The Patchstack entry for this vulnerability is the authoritative source for patch status: Patchstack WordPress Plugin Vulnerability. Confirm the installed plugin version through the WordPress admin dashboard after applying updates.

Workarounds

Deactivate and remove the Form Maker plugin until a patched release is installed
Restrict plugin management and form editing to a minimal set of trusted administrators
Enforce a strict Content Security Policy that disallows inline scripts and unknown script sources
Place the WordPress site behind a WAF configured with rules that block XSS payloads targeting plugin endpoints

bash

# Configuration example: verify installed plugin version and enforce least privilege
wp plugin get form-maker --field=version
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
wp plugin deactivate form-maker