CVE-2026-85645 is a reflected cross-site scripting vulnerability in the Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin. The issue exists in the bulk_action parameter due to inadequate sanitization and escaping of user input, enabling unauthenticated attackers to inject malicious scripts. This can lead to script execution in the context of the victim's browser if they interact with a crafted URL or action. The vulnerability affects all versions up to and including 1.15.46. The CVSS 3.1 base score is 6.1, reflecting medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and partial impact on confidentiality and integrity.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of a victim's browser session, potentially leading to theft of sensitive information or session hijacking. The impact is limited to confidentiality and integrity with no availability impact. The attack requires user interaction (clicking a malicious link). No known exploits are reported in the wild.

No official fix or patch is currently available. Users should monitor the vendor's advisory for updates. Until a patch is released, avoid clicking on suspicious links related to the affected plugin and consider disabling or removing the plugin if feasible. Implementing web application firewall (WAF) rules to block malicious input targeting the bulk_action parameter may provide temporary mitigation.