{"id":"CVE-2026-105413","published":"2026-11-04T06:16:57.460","lastModified":"2026-11-04T06:16:57.460","description":"The Form Maker by 10Web  WordPress plugin before 1.15.51 does not consistently escape user-submitted field values before rendering them on its submissions admin page, allowing unauthenticated users to store a payload that executes as arbitrary web scripts in the session of an administrator who views the submissions.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/d992e80b-5c69-44ea-8dcc-7c8d2768115f/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}