Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Form Maker by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.15.35. This is due to the plugin's default file upload allowlist including SVG files combined with weak substring-based extension validation. This makes it possible for unauthenticated attackers to upload malicious SVG files containing JavaScript code that will execute when viewed by administrators or site visitors via file upload fields in forms granted they can submit forms.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-1065 Stored XSS in Form Maker by 10Web WordPress Plugin via SVG File Upload https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-1065
Post summary
A stored XSS vulnerability (CVE-2026-1065) was identified in the Form Maker by 10Web WordPress plugin, exploitable through uploading malicious SVG files.
CVE-2026-1065 The Form Maker by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.15.35. This is due to the plugin's def… https://www.cve.org/CVERecord?id=CVE-2026-1065
Post summary
CVE-2026-1065 is disclosed as affecting the Form Maker plugin (10Web) up to version 1.15.35, with a stored XSS vulnerability.