CVE-2026-96813 is a stored cross-site scripting vulnerability (CWE-79) in the Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin. The flaw arises from insufficient input sanitization and output escaping in the Longitude/Latitude fields of the Mark on Map feature. This enables unauthenticated attackers to inject arbitrary web scripts that execute in the context of users visiting the injected pages. The vulnerability affects all plugin versions from 0 up to and including 1.15.47.

Successful exploitation allows attackers to execute arbitrary scripts in the browsers of users who visit pages containing the injected payload. This can lead to information disclosure, session hijacking, or other client-side impacts. The vulnerability does not require authentication and has a CVSS 3.1 score of 7.2 (high severity), indicating significant risk to confidentiality and integrity but no impact on availability.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or restricting use of the vulnerable fields or plugin. Monitoring vendor channels for updates is recommended.