{"affected":[{"defaultStatus":"unaffected","product":"Form Maker by 10Web","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"1.15.51","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-105413","cwes":["CWE-79"],"description":"The Form Maker by 10Web  WordPress plugin before 1.15.51 does not consistently escape user-submitted field values before rendering them on its submissions admin page, allowing unauthenticated users to store a payload that executes as arbitrary web scripts in the session of an administrator who views the submissions.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/d992e80b-5c69-44ea-8dcc-7c8d2768115f/"}],"kev":null,"metrics":[],"modifiedAt":1793772024194,"publishedAt":1793772024194,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/d992e80b-5c69-44ea-8dcc-7c8d2768115f/"}],"remediation":[],"revision":"5fb9f2eb7fb0c9f08c61b7abe25f07f69d50e29e02968c19906737d8fccecd59","sources":[{"modifiedAt":1793772024194,"name":"CNA: WPScan","retrievedAt":1793776114196,"url":"https://www.cve.org/CVERecord?id=CVE-2026-105413"}],"ssvc":null,"status":"published","title":"Form Maker by 10Web < 1.15.51 - Unauthenticated Stored XSS via Submission Field Values","updatedAt":1793776114196}