High · published February 3, 2026
⚡ An unauthenticated attacker can inject scripts into the WordPress admin area, thanks to a sneaky Stored XSS vulnerability in the Form Maker plugin! 😱 Think of it like a restaurant where an unsuspecting chef finds a menu with hidden surprises — the hidden field values in the plugin are like those surprise ingredients that shouldn’t be there, but can turn into danger when served up! 🍽️ Once exploited, an attacker can run any JavaScript they want when an admin checks the submissions list, leading to devastating outcomes like data theft or unauthorized actions. It's like handing a thief the keys to your kitchen, letting them cook up havoc while you're none the wiser! 🔥
Think of it like a restaurant where an unsuspecting chef finds a menu with hidden surprises — the hidden field values in the plugin are like those surprise ingredients that shouldn’t be there, but can turn into danger when served up! 🍽️ This vulnerability arises from insufficient output escaping of user-supplied hidden field values. Specifically, the plugin uses html_entity_decode() but doesn't escape the values before output, allowing malicious scripts to execute when displayed in the admin submissions list.
Once exploited, an attacker can run any JavaScript they want when an admin checks the submissions list, leading to devastating outcomes like data theft or unauthorized actions. It's like handing a thief the keys to your kitchen, letting them cook up havoc while you're none the wiser! 🔥 Immediately update the Form Maker plugin to version 1.15.36 or later. Review your security settings and consider implementing additional validation on user inputs to prevent similar vulnerabilities. Don't forget to educate your team about safe practices when managing admin submissions! 🛡️ You've got this! With these fixes, you'll fortify your site and keep those pesky scripts at bay! 💪✨