📄 Description (English)
The Form Maker by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Matrix field (Text Box input type) in form submissions in all versions up to, and including, 1.15.40. This is due to insufficient input sanitization (`sanitize_text_field` strips tags but not quotes) and missing output escaping when rendering submission data in the admin Submissions view. This makes it possible for unauthenticated attackers to inject arbitrary JavaScript through a form submission that executes in the browser of an administrator who views the submission details.
🤖 AI Executive Summary
The Form Maker by 10Web WordPress plugin (versions ≤1.15.40) contains a Stored Cross-Site Scripting (XSS) vulnerability in the Matrix field that allows unauthenticated attackers to inject malicious JavaScript through form submissions. When administrators view submission details, the injected script executes with admin privileges, potentially leading to account compromise, data theft, or malware distribution. This vulnerability affects all WordPress installations using this popular form plugin without proper input validation.
📄 Description (Arabic)
🤖 AI Intelligence Analysis Analyzed: May 8, 2026 20:23
🇸🇦 Saudi Arabia Impact Assessment
Saudi organizations using WordPress with Form Maker plugin are at significant risk, particularly: (1) Government agencies and municipalities collecting citizen data through online forms; (2) Banking and financial institutions using forms for customer onboarding and service requests; (3) Healthcare providers (Ministry of Health, private hospitals) collecting patient information; (4) Educational institutions (universities, TVTC) managing student applications; (5) Telecom companies (STC, Mobily, Zain) processing customer inquiries; (6) E-commerce platforms and SMEs. The vulnerability enables attackers to steal admin session cookies, modify form data, inject malware, or conduct phishing attacks against high-value targets accessing the admin panel.
🏢 Affected Saudi Sectors
Government and Public Administration
Banking and Financial Services
Healthcare and Medical Services
Education and Universities
Telecommunications
E-commerce and Retail
Energy and Utilities
Insurance
Real Estate and Property Management
Hospitality and Tourism
🎯 MITRE ATT&CK Techniques
⚖️ Saudi Risk Score (AI)
7.8
/ 10.0
🔧 Remediation Steps (English)
IMMEDIATE ACTIONS:
1. Disable the Form Maker plugin immediately via WordPress admin dashboard or command line (wp plugin deactivate form-maker-by-10web)
2. Audit all form submissions in the plugin database for suspicious JavaScript patterns (look for <script>, onclick=, onerror=, etc.)
3. Review WordPress admin access logs for unauthorized activities during the vulnerability window
4. Reset passwords for all WordPress administrator accounts
5. Check for unauthorized admin user accounts created via XSS injection
PATCHING GUIDANCE:
- Monitor 10Web's official website and WordPress plugin repository for security updates
- Once patch is released (expected version 1.15.41+), immediately update the plugin
- Test updates in staging environment before production deployment
- Consider alternative form plugins (WPForms, Gravity Forms, Formidable Forms) with better security records
COMPENSATING CONTROLS (if patch unavailable):
- Implement Web Application Firewall (WAF) rules to block XSS payloads in form submissions
- Use WordPress security plugins (Wordfence, Sucuri) with XSS detection
- Restrict admin panel access via IP whitelisting
- Implement Content Security Policy (CSP) headers to prevent inline script execution
- Enable WordPress security headers (X-Frame-Options, X-Content-Type-Options)
DETECTION RULES:
- Monitor database for form submissions containing: script tags, event handlers (onclick, onerror, onload), encoded payloads
- Alert on admin access to Form Maker submissions view
- Monitor wp-admin access logs for unusual patterns
- Check for new admin user creation events
- Monitor for changes to WordPress core files or plugin files
🔧 خطوات المعالجة (العربية)
الإجراءات الفورية:
1. تعطيل مكون Form Maker فوراً عبر لوحة تحكم WordPress أو سطر الأوامر
2. تدقيق جميع إرسالات النماذج في قاعدة بيانات المكون للبحث عن أنماط JavaScript مريبة
3. مراجعة سجلات الوصول لمسؤول WordPress للأنشطة غير المصرح بها
4. إعادة تعيين كلمات المرور لجميع حسابات مسؤول WordPress
5. التحقق من حسابات مسؤول غير مصرح بها تم إنشاؤها عبر حقن XSS
إرشادات التصحيح:
- مراقبة موقع 10Web الرسمي ومستودع مكونات WordPress للتحديثات الأمنية
- بمجرد إصدار التصحيح، قم بتحديث المكون فوراً
- اختبر التحديثات في بيئة التدريج قبل النشر في الإنتاج
- فكر في مكونات نماذج بديلة بسجلات أمان أفضل
الضوابط البديلة:
- تنفيذ قواعد جدار حماية تطبيقات الويب لحظر حمولات XSS
- استخدام مكونات أمان WordPress مع كشف XSS
- تقييد الوصول إلى لوحة التحكم عبر القائمة البيضاء للعناوين
- تنفيذ رؤوس سياسة أمان المحتوى
- تفعيل رؤوس أمان WordPress
قواعد الكشف:
- مراقبة قاعدة البيانات للإرسالات التي تحتوي على علامات البرنامج النصي
- التنبيه على وصول المسؤول إلى عرض الإرسالات
- مراقبة سجلات الوصول لـ wp-admin
- التحقق من أحداث إنشاء مستخدم مسؤول جديد
- مراقبة التغييرات على ملفات WordPress الأساسية
📋 Regulatory Compliance Mapping
🟢 NCA ECC 2024
5.1.1 - Input validation and sanitization controls
5.1.2 - Output encoding and escaping requirements
5.2.1 - Web application security controls
5.2.2 - Protection against injection attacks
6.1.1 - Vulnerability management and patching
6.2.1 - Security monitoring and logging
🔵 SAMA CSF
ID.GV-1 - Organizational cybersecurity policy and governance
PR.DS-1 - Data security and protection measures
PR.IP-1 - Security development practices
DE.CM-1 - Detection and monitoring of security events
RS.RP-1 - Response and recovery planning
🟡 ISO 27001:2022
A.14.2.1 - Secure development policy
A.14.2.5 - Access control for development
A.14.3.1 - Segregation of development, test and production environments
A.12.6.1 - Management of technical vulnerabilities
A.12.2.1 - Restriction of access to information
🟣 PCI DSS v4.0.1
6.5.1 - Injection flaws prevention
6.5.7 - Cross-site scripting (XSS) prevention
6.2 - Security patches and updates
11.2 - Vulnerability scanning and assessment
🔗 References & Sources 5
🔗
🔗
🔗
🔗
🔗
https://plugins.trac.wordpress.org/browser/form-maker/tags/1.15.37/admin/views/FormMake...
security@wordfence.com
https://plugins.trac.wordpress.org/browser/form-maker/tags/1.15.37/admin/views/FormMake...
security@wordfence.com
https://plugins.trac.wordpress.org/browser/form-maker/tags/1.15.37/frontend/models/form...
security@wordfence.com
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=350169...
security@wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/197449f5-9304-49df-9261-a3541...
security@wordfence.com