The Form Maker plugin for WordPress suffers from a stored XSS vulnerability due to insufficient output escaping of hidden field values in the admin submissions list. Specifically, the plugin decodes HTML entities from user input using html_entity_decode() but fails to re-escape the output before rendering it in the admin interface. This flaw enables unauthenticated attackers to inject arbitrary JavaScript payloads that execute in the context of an administrator's browser upon viewing the submissions list. The vulnerability affects all versions up to 1.15.35 and has a CVSS 3.1 base score of 7.1, indicating high severity. No known exploits in the wild have been reported, and no patch or remediation details are currently available.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the administrator's browser when they view the submissions list. This can lead to compromise of administrative sessions, data theft, or further attacks within the administrative context. The vulnerability impacts confidentiality, integrity, and availability as indicated by the CVSS vector (C:L/I:L/A:L).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should limit access to the submissions list to trusted users only and consider monitoring for suspicious activity. Avoid opening the submissions list in untrusted environments. Follow updates from 10Web for any released patches or official mitigations.