The Form Maker by 10Web plugin for WordPress suffers from CWE-434: Unrestricted Upload of File with Dangerous Type. The vulnerability arises because the plugin's default file upload allowlist includes SVG files, and the extension validation is based on weak substring matching. This flaw permits unauthenticated attackers to upload SVG files embedding malicious JavaScript. When these files are viewed by administrators or site visitors through form upload fields, the embedded script executes, leading to stored XSS. The vulnerability affects all versions up to and including 1.15.35 and has a CVSS 3.1 base score of 7.2 (high severity).

Successful exploitation allows unauthenticated attackers to perform stored cross-site scripting attacks, potentially leading to the execution of arbitrary JavaScript in the context of the affected site. This can result in information disclosure or manipulation of site content as perceived by administrators or visitors. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, administrators should consider disabling SVG uploads or restricting file upload capabilities to trusted users only. Monitoring for suspicious uploaded files and removing any untrusted SVG files may reduce risk.