CVE-2026-85645 Overview
The Form Maker by 10Web WordPress plugin contains a Reflected Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 1.15.46. The flaw exists in the handling of the bulk_action parameter within the plugin's submissions controller. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts. Exploitation requires user interaction, such as tricking an authenticated administrator into clicking a crafted link. The vulnerability is tracked under CWE-79 and was patched in version 1.15.47.
Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in an administrator's browser session, enabling session theft, account takeover, or malicious redirects on affected WordPress sites.
Affected Products
- Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder for WordPress (versions ≤ 1.15.46)
- WordPress sites with the plugin installed and active
- Administrative users interacting with plugin submission pages
Discovery Timeline
- 2026-09-10 - CVE-2026-85645 published to NVD
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-85645
Vulnerability Analysis
The vulnerability resides in the plugin's submissions administrative controller (admin/controllers/Submissions_fm.php). The bulk_action request parameter is reflected into the HTML response without adequate sanitization or escaping. An attacker can craft a URL containing a malicious payload in bulk_action and deliver it via phishing or a malicious page. When a logged-in WordPress administrator visits the crafted URL, the injected script executes in the browser under the site's origin. Because the vulnerability requires only user interaction and no authentication on the attacker's side, the scope changes to affect the victim's authenticated session.
Root Cause
The underlying cause is missing output escaping when rendering the bulk_action parameter value back into administrative pages. The vulnerable rendering path also traverses helper code in framework/WDW_FM_Library.php. The fix in changeset 3686567 adds proper input handling to the submissions controller so that untrusted request data is no longer echoed unsafely into the DOM.
Attack Vector
Exploitation is network-based and unauthenticated but requires user interaction. An attacker crafts a URL pointing to the plugin's submissions endpoint with a JavaScript payload in bulk_action. The attacker then lures an authenticated administrator to click the link through email, social media, or a compromised web page. On click, the payload executes in the administrator's browser and can perform any action the user's session permits, including creating new admin accounts or exfiltrating cookies. See the Wordfence Vulnerability Analysis for additional context.
Detection Methods for CVE-2026-85645
Indicators of Compromise
- HTTP requests to WordPress admin endpoints containing bulk_action values with HTML tags, <script>, javascript:, event handler attributes (onerror, onload), or URL-encoded equivalents such as %3Cscript%3E.
- Unexpected outbound requests from administrator browsers to attacker-controlled domains immediately after visiting a plugin submissions page.
- Creation of unfamiliar WordPress administrator accounts or unauthorized modifications to plugin or theme files.
Detection Strategies
- Deploy web application firewall (WAF) rules that inspect the bulk_action query parameter for XSS payload signatures on requests targeting /wp-admin/admin.php?page=submissions_fm.
- Review WordPress and reverse-proxy access logs for suspicious query strings containing script-like content sent to Form Maker plugin endpoints.
- Correlate referer headers on admin traffic to identify off-site links driving administrators into the plugin's submissions pages.
Monitoring Recommendations
- Enable audit logging in WordPress to track administrator sessions, role changes, and plugin configuration edits.
- Alert on new administrator account creation or privilege elevation events occurring shortly after admin browser sessions load plugin URLs.
- Monitor Content Security Policy (CSP) violation reports for inline script executions originating from admin pages.
How to Mitigate CVE-2026-85645
Immediate Actions Required
- Update the Form Maker by 10Web plugin to version 1.15.47 or later on every affected WordPress site.
- Instruct administrators to avoid clicking untrusted links, particularly those referencing wp-admin URLs, until patching is complete.
- Rotate WordPress administrator credentials and invalidate active sessions if suspicious activity is observed.
Patch Information
The issue was corrected in Form Maker version 1.15.47. Review the fix in WordPress Changeset 3686567 and the full diff between releases in the 1.15.46 to 1.15.47 comparison. Administrators can update via the WordPress plugin management interface or WP-CLI.
Workarounds
- If immediate patching is not possible, temporarily deactivate the Form Maker by 10Web plugin from the WordPress admin panel.
- Enforce a strict Content Security Policy that disallows inline script execution within the WordPress admin area.
- Restrict access to /wp-admin/ by IP allowlist at the reverse proxy or WAF to reduce exposure to phishing-driven exploitation.
# Update Form Maker plugin to patched version using WP-CLI
wp plugin update form-maker --version=1.15.47
# Verify installed version
wp plugin get form-maker --field=version
# Temporary workaround: deactivate the plugin until patched
wp plugin deactivate form-maker
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
