CVE-2026-1058

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1058", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-16T18:20:44.141Z", "datePublished": "2026-02-03T06:38:05.509Z", "dateUpdated": "2026-04-08T17:28:49.695Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:28:49.695Z"}, "affected": [{"vendor": "10web", "product": "Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.15.35", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Form Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via hidden field values in all versions up to, and including, 1.15.35. This is due to insufficient output escaping when displaying hidden field values in the admin submissions list. The plugin uses html_entity_decode() on user-supplied hidden field values without subsequent escaping before output, which converts HTML entity-encoded payloads back into executable JavaScript. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in the admin submissions view that will execute whenever an administrator accesses the submissions list."}], "title": "Form Maker by 10Web <= 1.15.35 - Unauthenticated Stored Cross-Site Scripting via Hidden Field", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e0ec0027-2792-4069-b413-8fdd951f5fe7?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/form-maker/tags/1.15.34/admin/views/Submissions_fm.php#L759"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3447011%40form-maker%2Ftrunk&old=3440395%40form-maker%2Ftrunk&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "baseScore": 7.1, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Supakiad S."}], "timeline": [{"time": "2026-01-16T18:36:05.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-02-02T18:21:06.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-03T15:25:59.393794Z", "id": "CVE-2026-1058", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-03T15:30:21.249Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1058", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-03T15:25:59.393794Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-03T15:26:00.302Z"}}], "cna": {"title": "Form Maker by 10Web <= 1.15.35 - Unauthenticated Stored Cross-Site Scripting via Hidden Field", "credits": [{"lang": "en", "type": "finder", "value": "Supakiad S."}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"}}], "affected": [{"vendor": "10web", "product": "Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.15.35"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-16T18:36:05.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-02-02T18:21:06.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e0ec0027-2792-4069-b413-8fdd951f5fe7?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/form-maker/tags/1.15.34/admin/views/Submissions_fm.php#L759"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3447011%40form-maker%2Ftrunk&old=3440395%40form-maker%2Ftrunk&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Form Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via hidden field values in all versions up to, and including, 1.15.35. This is due to insufficient output escaping when displaying hidden field values in the admin submissions list. The plugin uses html_entity_decode() on user-supplied hidden field values without subsequent escaping before output, which converts HTML entity-encoded payloads back into executable JavaScript. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in the admin submissions view that will execute whenever an administrator accesses the submissions list."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:28:49.695Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1058", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:28:49.695Z", "dateReserved": "2026-01-16T18:20:44.141Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-03T06:38:05.509Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder", "vendor": "10web", "versions": [{"lessThanOrEqual": "1.15.35", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Form Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via hidden field values in all versions up to, and including, 1.15.35. This is due to insufficient output escaping when displaying hidden field values in the admin submissions list. The plugin uses html_entity_decode() on user-supplied hidden field values without subsequent escaping before output, which converts HTML entity-encoded payloads back into executable JavaScript. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in the admin submissions view that will execute whenever an administrator accesses the submissions list."}, {"lang": "es", "value": "El plugin Form Maker para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s de valores de campos ocultos en todas las versiones hasta la 1.15.35, inclusive. Esto se debe a un escape de salida insuficiente al mostrar los valores de los campos ocultos en la lista de env\u00edos del administrador. El plugin utiliza html_entity_decode() en valores de campos ocultos proporcionados por el usuario sin un escape posterior antes de la salida, lo que convierte las cargas \u00fatiles codificadas como entidades HTML de nuevo en JavaScript ejecutable. Esto hace posible que atacantes no autenticados inyecten scripts web arbitrarios en la vista de env\u00edos del administrador que se ejecutar\u00e1n cada vez que un administrador acceda a la lista de env\u00edos."}], "id": "CVE-2026-1058", "lastModified": "2026-06-17T10:14:55.440", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1058", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-03T15:25:59.393794Z", "version": "2.0.3"}}]}, "published": "2026-02-03T07:16:11.690", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/form-maker/tags/1.15.34/admin/views/Submissions_fm.php#L759"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3447011%40form-maker%2Ftrunk&old=3440395%40form-maker%2Ftrunk&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e0ec0027-2792-4069-b413-8fdd951f5fe7?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-15T21:29:45.123699+00:00", "value": {"mitigation_remediation": ["Upgrade the Form Maker plugin to version 1.15.36 or later, which removes the vulnerable code path.", "Until the patch is applied, disable the Form Maker plugin or delete the affected form(s) to eliminate the attack surface.", "Add server\u2011side validation that sanitizes and escapes hidden field values before storing or rendering them, for example by using esc_html() on all form inputs."], "summary": {"action": "Immediate Patch", "impact": "Stored cross-site scripting"}, "threat_synthesis": {"affected_systems": "All versions of the 10Web Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder plugin up to and including 1.15.35 are affected. The plugin is a WordPress add\u2011on that is publicly available on the WordPress plugin repository.", "description_and_impact": "The Form Maker plugin for WordPress is vulnerable to stored cross-site scripting via hidden field values. Because the plugin applies html_entity_decode() to user-supplied hidden fields without escaping the result, an attacker can inject JavaScript that will be executed whenever an administrator views the submissions list. This leads to arbitrary code execution in the context of the admin user, allowing credential theft, defacement, data exfiltration and other malicious actions.", "risk_and_exploitability": "The vulnerability scores a CVSS of 7.1 and an EPSS of <1\u202f%. It is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers can exploit it by submitting a form with a malicious payload in a hidden field, a task that does not require authentication. When an admin later views that submission, the injected script runs with the admin\u2019s privileges. The low EPSS indicates that, so far, no widespread exploitation has been observed, but the impact is high if utilized."}}}}, "created": "2026-02-04T12:14:57.151912+00:00", "updated": "2026-04-15T21:30:13.899849+00:00", "vendors": ["10web", "10web$PRODUCT$form_maker", "wordpress", "wordpress$PRODUCT$wordpress"]}