High · published February 3, 2026
⚡ Unauthenticated attackers can upload booby-trapped SVG files thanks to a weak validation in the Form Maker plugin for WordPress. This vulnerability is like a sneaky chef slipping a hidden ingredient into the recipe without the restaurant ever noticing! Think of the Form Maker plugin as a restaurant that has a buffet of files. The chef allows entries without checking the ingredients closely, leaving the door wide open for a dishonest guest to add something dangerous — like a poisoned dish — that affects everyone who tries it! An attacker could exploit this vulnerability to upload malicious SVG files loaded with JavaScript code, which would execute when administrators or other site visitors view the affected forms. This could lead to unauthorized actions, data theft, or even a full site takeover!
Think of the Form Maker plugin as a restaurant that has a buffet of files. The chef allows entries without checking the ingredients closely, leaving the door wide open for a dishonest guest to add something dangerous — like a poisoned dish — that affects everyone who tries it! This Stored Cross-Site Scripting (XSS) vulnerability in the Form Maker plugin arises from inadequate validation of file uploads, specifically allowing SVG files that can contain executable scripts. It enables attackers to insert harmful code into forms that execute when users interact with them.
An attacker could exploit this vulnerability to upload malicious SVG files loaded with JavaScript code, which would execute when administrators or other site visitors view the affected forms. This could lead to unauthorized actions, data theft, or even a full site takeover! To safeguard your site, immediately update the Form Maker plugin to version 1.15.36 or later. Additionally, consider implementing stricter file upload validation and filtering rules to prevent future upload issues. Regularly review your plugins for updates and vulnerabilities. You've got this! By following these steps, you're on your way to keeping your WordPress site safe and sound! 🛡️