PT-2026-6029 · WordPress+1 · Wordpress+1

Supakiad S · Published 2026-02-03 · Updated 2026-02-03 · CVE-2026-1065

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Form Maker by 10Web plugin for WordPress versions through 1.15.35

Description The Form Maker by 10Web plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is a result of the plugin allowing SVG file uploads with insufficient extension validation. Unauthenticated attackers can upload malicious SVG files containing JavaScript code. This code will execute when administrators or site visitors view the uploaded files through form upload fields, provided they have form submission privileges.

Recommendations Update the Form Maker by 10Web plugin to a version later than 1.15.35.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-1065

Affected Products

Form Maker

Wordpress

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-1065 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3447011%40form-maker%2Ftrunk&old=3440395%40form-maker%2Ftrunk&sfp_email=&sfph_mail= · Note
• https://t.me/CVEtracker/43574 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2018724892451938611 · Twitter Post
• https://plugins.trac.wordpress.org/browser/form-maker/tags/1.15.34/frontend/models/form_maker.php#L1744 · Note
• https://plugins.trac.wordpress.org/browser/form-maker/tags/1.15.34/js/add_field.js#L2364 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/8230d5f8-01d9-465a-8a43-e9852248bb3d?source=cve · Note
• https://t.me/cveNotify/150691 · Telegram Post
• https://plugins.trac.wordpress.org/browser/form-maker/tags/1.15.34/frontend/models/form_maker.php#L1855 · Note