CVE-2026-103998: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in 10web Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder

CVE-2026-103998 describes a reflected cross-site scripting vulnerability in the Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin. The vulnerability exists in the 'inputs' array key parameter due to improper neutralization of input during web page generation (CWE-79). This allows unauthenticated attackers to inject arbitrary web scripts that execute in the context of a victim's browser if the victim is tricked into clicking a malicious link. The vulnerability affects all plugin versions from 0 up to and including 1.15.48.

Successful exploitation can lead to limited confidentiality and integrity impacts by executing arbitrary scripts in the context of the victim's browser. This may allow attackers to steal user session data or perform actions on behalf of the user. There is no impact on availability. The CVSS v3.1 base score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and partial confidentiality and integrity impact.

No official patch or fix is currently confirmed for this vulnerability. Users should check the vendor advisory for updates. Until a fix is available, users should consider disabling or removing the affected plugin versions or applying any recommended temporary mitigations from the vendor. Additionally, users should be cautious about clicking untrusted links that may trigger this vulnerability.