The Form Maker by 10Web plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, the Matrix field (Text Box input type) in form submissions does not properly sanitize input because `sanitize_text_field` removes tags but not quotes, and the output is not escaped when rendering submission data in the admin interface. This allows unauthenticated attackers to inject JavaScript that executes in the context of an administrator's browser when viewing submission details. The vulnerability affects all versions up to and including 1.15.40 and has a CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N). No patch or official fix has been published yet.

Successful exploitation allows unauthenticated attackers to inject and execute arbitrary JavaScript in the browser of an administrator viewing form submissions. This can lead to partial confidentiality and integrity loss, such as session hijacking or unauthorized actions performed with administrator privileges. Availability is not impacted. The vulnerability is rated high severity with a CVSS score of 7.2.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution when viewing form submissions from untrusted sources. Consider restricting access to the submissions view to trusted users only and monitoring for suspicious activity. Avoid using the affected plugin versions if possible.