CVE-2026-66616— WordPress Form Maker by 10Web plugin <= 1.15.46 - Cross Site Scripting (XSS) vulnerability
Quick assessment
Affected
10Web Form Maker by 10Web
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在10Web的Form Maker插件中，存在未经身份验证的跨站脚本（XSS）漏洞，影响版本≤1.15.46。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| 10Web | Form Maker by 10Web | n/a≤ 1.15.46 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-66616
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress Form Maker by 10Web plugin <= 1.15.46 - Cross Site Scripting (XSS) vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Unauthenticated Cross Site Scripting (XSS) in Form Maker by 10Web <= 1.15.46 versions.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| 10Web | Form Maker by 10Web | n/a ~ 1.15.46 | - |
|
II. Public POCs for CVE-2026-66616
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-66616
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: Form Maker by 10Web
-
CVE-2026-16977
Form Maker by 10Web < 1.15.45 - Subscriber+ SQL Injection vi -
CVE-2026-39502
WordPress Form Maker by 10Web plugin <= 1.15.38 - SQL Inject -
CVE-2025-15441
Form Maker < 1.15.38 - SQL Injection -
CVE-2025-48341
WordPress Form Maker by 10Web plugin <= 1.15.33 - Cross Site -
CVE-2024-13053
Form Maker by 10Web < 1.15.33 - Admin+ Stored XSS via Theme
Same vendor: 10Web
-
CVE-2026-66635
WordPress Slider by 10Web plugin <= 1.2.62 - CSRF to Arbitra -
CVE-2026-15993
Form Maker by 10Web <= 1.15.44 - Authenticated (Subscriber+) -
CVE-2026-11776
Form Maker by 10Web <= 1.15.43 - Authenticated (Adminsitrato -
CVE-2026-11777
Form Maker by 10Web <= 1.15.43 - Authenticated (Administrato -
CVE-2026-39502
WordPress Form Maker by 10Web plugin <= 1.15.38 - SQL Inject
Same weakness: CWE-79
-
CVE-2026-71503
Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administrat -
CVE-2026-30864
Combodo iTop: Reflected XSS in dashboard revert -
CVE-2026-76837
Baserow before 2.3.0 Stored Cross-Site Scripting via Rich Te -
CVE-2026-65053
Horde IMP before 7.2.0 Stored Cross-Site Scripting via Apple -
CVE-2026-78414
Cross-site scripting in Nx Witness VMS Web Administration al
V. Comments for CVE-2026-66616
No comments yet