PT-2026-6029 · WordPress+1 · Wordpress+1

Supakiad S · Publicado 2026-02-03 · Atualizado 2026-02-03 · CVE-2026-1065

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Form Maker by 10Web plugin for WordPress versions through 1.15.35

Description The Form Maker by 10Web plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is a result of the plugin allowing SVG file uploads with insufficient extension validation. Unauthenticated attackers can upload malicious SVG files containing JavaScript code. This code will execute when administrators or site visitors view the uploaded files through form upload fields, provided they have form submission privileges.

Recommendations Update the Form Maker by 10Web plugin to a version later than 1.15.35.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2026-1065

Produtos afetados

Form Maker

Wordpress

Referências · 9

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3447011%40form-maker%2Ftrunk&old=3440395%40form-maker%2Ftrunk&sfp_email=&sfph_mail= · Nota
• https://t.me/CVEtracker/43574 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2018724892451938611 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/form-maker/tags/1.15.34/frontend/models/form_maker.php#L1744 · Nota
• https://plugins.trac.wordpress.org/browser/form-maker/tags/1.15.34/js/add_field.js#L2364 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-1065 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/8230d5f8-01d9-465a-8a43-e9852248bb3d?source=cve · Nota
• https://t.me/cveNotify/150691 · Publicação no Telegram
• https://plugins.trac.wordpress.org/browser/form-maker/tags/1.15.34/frontend/models/form_maker.php#L1855 · Nota