PT-2026-6028 · WordPress · Wordpress+1

Supakiad S · Published 2026-02-03 · Updated 2026-02-03 · CVE-2026-1058

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Form Maker plugin for WordPress versions prior to 1.15.36

Description The Form Maker plugin for WordPress is susceptible to Stored Cross-Site Scripting through hidden field values. Insufficient output escaping when displaying these values in the admin submissions list allows for the execution of arbitrary web scripts. The plugin utilizes html entity decode() on user-supplied hidden field values without subsequent escaping before output, converting HTML entity-encoded payloads into executable JavaScript. This enables unauthenticated attackers to inject malicious scripts into the admin submissions view, which will execute when an administrator accesses the submissions list.

Recommendations Update the Form Maker plugin to version 1.15.36 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-1058

Affected Products

Form Maker

Wordpress

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-1058 · Security Note
• https://twitter.com/VulmonFeeds/status/2018727452399255762 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3447011%40form-maker%2Ftrunk&old=3440395%40form-maker%2Ftrunk&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/browser/form-maker/tags/1.15.34/admin/views/Submissions_fm.php#L759 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/e0ec0027-2792-4069-b413-8fdd951f5fe7?source=cve · Note
• https://t.me/CVEtracker/43573 · Telegram Post
• https://t.me/cveNotify/150690 · Telegram Post