Threats tagged 'ghsa-8642-5jh7-q996'

The Form Maker by 10Web WordPress plugin up to version 1.15.50 is vulnerable to stored cross-site scripting (XSS) due to insufficient input sanitization and output escaping. The vulnerability involves crafted parameters that allow unauthenticated attackers to inject malicious scripts that execute when an administrator views form submissions. Exploitation requires the targeted form to have a File Upload field and manipulation of the disabled_fields parameter to bypass escaping.