CVE-2024-43220 is a reflected Cross-site Scripting (XSS) vulnerability identified in the 10Web Form Builder Team's Form Maker plugin for WordPress, affecting versions through 1.15.26. The issue stems from improper neutralization of input during web page generation, classified under CWE-79. This allows an attacker to craft malicious input that, when reflected in the web page output, executes arbitrary scripts in the victim's browser. The vulnerability has a CVSS 3.1 base score of 7.1, with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability. No official fix or patch has been released as of the publication date.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the context of the victim's browser, potentially resulting in theft of sensitive information, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability of user data. The reflected nature of the XSS requires user interaction to trigger the malicious payload. There are no known active exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with untrusted input and consider implementing web application firewall (WAF) rules to detect and block reflected XSS attempts. Monitor 10Web's official channels for updates and apply patches promptly once available.