The Form Maker by 10Web plugin for WordPress suffers from a stored XSS vulnerability due to improper neutralization of input during web page generation (CWE-79). Specifically, the Matrix field (Text Box input type) in form submissions does not properly sanitize input because `sanitize_text_field` removes tags but not quotes, and the plugin fails to escape output when rendering submission data in the admin interface. This allows unauthenticated attackers to inject JavaScript payloads that execute in the context of an administrator's browser when viewing the affected submissions.

An attacker can exploit this vulnerability to execute arbitrary JavaScript in the browser of an administrator viewing form submissions. This can lead to session hijacking, privilege escalation, or other malicious actions within the admin context. The vulnerability does not require authentication and has a low attack complexity with no user interaction needed beyond the admin viewing the submission. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution when viewing form submissions from untrusted sources. Consider restricting access to the Submissions view to trusted users only and monitoring for suspicious activity. Avoid opening submissions from unknown or untrusted users. Follow the vendor's updates closely for any forthcoming patches or official mitigations.