CVE-2026-96813 Overview
CVE-2026-96813 is a Stored Cross-Site Scripting (XSS) vulnerability in the Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress. The flaw affects all versions up to and including 1.15.47. Unauthenticated attackers can inject arbitrary web scripts through the Mark on Map Longitude and Latitude fields. The payload executes whenever a user accesses an injected page, enabling session theft, administrative action abuse, and site defacement.
Critical Impact
Unauthenticated attackers can inject persistent JavaScript that executes in the browsers of site visitors and authenticated administrators.
Affected Products
- Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress
- All versions up to and including 1.15.47
- Fixed in version 1.15.48
Discovery Timeline
- 2026-10-01 - CVE-2026-96813 published to the National Vulnerability Database (NVD)
- 2026-10-03 - Last updated in NVD database
Technical Details for CVE-2026-96813
Vulnerability Analysis
The vulnerability is a Stored Cross-Site Scripting (XSS) issue classified under [CWE-79]. User-supplied values submitted through the Mark on Map Longitude and Latitude fields are stored in the WordPress database. The plugin fails to apply sufficient input sanitization at ingestion and does not escape the values when rendering them in subsequent pages. Any user viewing an affected submission or administrative view triggers execution of the injected JavaScript.
Because the attack vector is network-based and requires no authentication or user interaction beyond viewing the affected page, attackers can target form submission endpoints directly. The scope-change characteristic indicates that script execution can impact resources beyond the vulnerable component, including administrator sessions and other authenticated users browsing the WordPress admin dashboard.
Root Cause
The root cause is missing sanitization and output escaping across multiple code paths that handle map coordinate values. Affected source locations include admin/controllers/FormMakerMapEditinPopup.php, admin/views/FMMapEditinPopup.php, admin/views/Submissions_fm.php, framework/WDW_FM_Library.php, and frontend/models/form_maker.php. Longitude and latitude inputs are accepted and rendered without being passed through WordPress sanitization helpers such as sanitize_text_field() or escaped via esc_html() or esc_attr() before output.
Attack Vector
An unauthenticated attacker submits a form containing a Mark on Map field with a payload substituted for the longitude or latitude value. The malicious value persists in the database. When an administrator reviews the submission in the WordPress backend, or any user accesses a page that renders the stored coordinate, the browser interprets the injected markup as executable script. Typical outcomes include administrator session token exfiltration, forced creation of attacker-controlled accounts through authenticated AJAX actions, and injection of further backdoors into site content.
See the Wordfence Vulnerability Report and the WordPress Form Maker Changeset 3716587 for technical details on the vulnerable sinks and the applied fix.
Detection Methods for CVE-2026-96813
Indicators of Compromise
- Form submissions in the wp_formmaker_submits table containing HTML tags such as <script>, <img onerror=, or <svg onload= inside longitude or latitude columns.
- Unexpected outbound requests from administrator browsers to attacker-controlled domains following access to the Form Maker submissions view.
- Newly created WordPress administrator accounts or modified wp_options entries following administrator activity in the Form Maker interface.
Detection Strategies
- Query the Form Maker submissions database for coordinate field values containing non-numeric characters, HTML entities, or URL-encoded payloads.
- Deploy a Web Application Firewall (WAF) rule that inspects POST requests to Form Maker endpoints for script tags and JavaScript event handlers in map coordinate parameters.
- Review WordPress audit logs for atypical administrator actions correlated with submission viewing timestamps.
Monitoring Recommendations
- Enable file integrity monitoring on the wp-content/plugins/form-maker/ directory to detect tampering.
- Monitor web server access logs for repeated POST requests to pages hosting Form Maker instances from the same IP address with anomalous payload sizes.
- Alert on administrator session activity originating from unexpected IP addresses or geolocations immediately after submission review.
How to Mitigate CVE-2026-96813
Immediate Actions Required
- Upgrade the Form Maker by 10Web plugin to version 1.15.48 or later on all WordPress installations.
- Audit existing Form Maker submissions for stored payloads and purge entries containing suspicious coordinate values.
- Rotate credentials and invalidate active sessions for any administrator who accessed the Form Maker submissions view before patching.
Patch Information
The vendor addressed the issue in version 1.15.48. The fix is documented in WordPress Form Maker Changeset 3716587 and WordPress Form Maker Changeset 3716589, which introduce proper escaping on the map coordinate output paths.
Workarounds
- Disable and remove the Form Maker plugin until the patched version can be deployed.
- Restrict access to pages hosting Form Maker instances using IP allowlisting or authentication requirements at the web server level.
- Deploy a WAF virtual patch that blocks requests containing script tags or JavaScript event handlers in longitude and latitude form fields.
# Update the Form Maker plugin to the patched version using WP-CLI
wp plugin update form-maker --version=1.15.48
# Verify the installed version after update
wp plugin get form-maker --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
