CVE-2024-10265

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources
Severity
6.1MEDIUM
EPSS
1.7%
top 17.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
10web Form Maker10web Form Maker BY 10web – Mobile-friendly Drag & Drop Contact Form Builder
Timeline
PublishedNov 10

Description

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.15.30. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶NVD10web/form_maker< 1.15.31

Patches

Patch: plugins.trac.wordpress.org ↗

🔴Vulnerability Details

2
CVEList
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.30 - Reflected Cross-Site Scripting via add_query_arg Parameter↗2024-11-10
▶
GHSA
GHSA-qgp6-r2cc-vww6: The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to↗2024-11-10
▶
CVE-2024-10265 (MEDIUM CVSS 6.1) | The Form Maker by 10Web – Mobile-Fr | cvebase.io