CVE-2026-96813

validated

GHSA-6hr3-5gmx-jj2q ↗EUVD-2026-90571 ↗

check availablenot proven exploitable

cve.orgpublic pockev

10web Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.47

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

ETK-2026-416, permanent identifier

cvss7.2cna vendorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

+1.9dTTV

42mAI analysis

Check if you are vulnerable

timeline

0 = cve.org publication

trigger signal (cve.org) +0dcheck available+1.9dagent stopped

+1d

+2d

description

Form Maker by 10Web versions through 1.15.47 are affected by stored cross-site scripting in Mark on Map longitude and latitude fields. An unauthenticated attacker may cause browser-executed content to be stored on a page and run when another user views that page.

mitigation

Disable the plugin or remove public access to forms using Mark on Map fields until a patched release is confirmed. Review affected pages for unexpected stored content.

check

available

exploit

automation

deterministic

auth required

EPSS

0.30%21st percentile

agent run time

42m

cve.org record, t = 0

2026-10-01 08:28Z

Δ to public poc

–

Δ to kev

–

outcome

Check only, differential: the check fires on the vulnerable build and is silent on the patched one.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-10-01 08:28Z
cve_org: trigger signal, started the run
https://www.cve.org/CVERecord?id=CVE-2026-96813

this entry in the feed

GET /api/v1/feed/CVE-2026-96813

{
  "etk_id": "ETK-2026-416",
  "cve_id": "CVE-2026-96813",
  "display_id": "CVE-2026-96813",
  "ghsa_id": "GHSA-6hr3-5gmx-jj2q",
  "euvd_id": "EUVD-2026-90571",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Stored cross-site scripting in Form Maker by 10Web",
  "summary": "Form Maker by 10Web versions through 1.15.47 are affected by stored cross-site scripting in Mark on Map longitude and latitude fields. An unauthenticated attacker may cause browser-executed content to be stored on a page and run when another user views that page.",
  "mitigation": "Disable the plugin or remove public access to forms using Mark on Map fields until a patched release is confirmed. Review affected pages for unexpected stored content.",
  "vendor": "10web",
  "product": "Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.15.47"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder",
      "purl": null
    }
  ],
  "cwes": [
    79
  ],
  "cvss_score": 7.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "epss_score": 0.003,
  "epss_percentile": 0.2176,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 41.723889283333335,
  "t0_at": "2026-10-01T08:28:44.737000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-03T05:22:22.994346+00:00",
      "days": 1.8705816822453705,
      "is_lower_bound": false,
      "measured_at": "2026-10-01T08:28:44.737000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-01T08:28:44.737000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-01T08:28:44.737000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96813"
    }
  }
}

published 2026-10-03 04:40Z
last change 2026-10-21 17:47Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.