Is CVE-2026-119483 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119483 being exploited in the wild.

How severe is CVE-2026-119483?

High severity, with a CVSS score of 7.1, published 9 November 2026.

Which products and versions are affected?

10Web Form Maker through 1.15.50.

Is there a fix for CVE-2026-119483?

Yes: fixed in 1.15.51. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-119483 attacked?

It is attacked over the network.

Am I affected by CVE-2026-119483?

Check whether you run 10Web Form Maker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119483: 10Web Form Maker stored cross-site scripting (XSS)

CVE-2026-119483 · Severity: high · CVSS 7.1 · Published 2026-11-09

Form Maker by 10Web is a WordPress plugin that enables users to create and manage web forms on their sites. A stored cross-site scripting (XSS) vulnerability allows attackers to inject malicious scripts that persist in the form data and execute in visitors' browsers, potentially stealing credentials or hijacking accounts. The vulnerability requires a privileged user to be tricked into interacting with a malicious link or form, but affects all site visitors once the payload is stored.

Technologies: 10Web Form Maker. Vendors: 10Web.

Quick answers

Is CVE-2026-119483 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119483 being exploited in the wild.
How severe is CVE-2026-119483?: High severity, with a CVSS score of 7.1, published 9 November 2026.
Which products and versions are affected?: 10Web Form Maker through 1.15.50.
Is there a fix for CVE-2026-119483?: Yes: fixed in 1.15.51. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-119483 attacked?: It is attacked over the network.
Am I affected by CVE-2026-119483?: Check whether you run 10Web Form Maker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.15.51

Technical details

The plugin fails to properly neutralize user input during web page generation, allowing stored XSS injection. An unauthenticated attacker can craft a malicious payload that, when a privileged user interacts with it (such as by visiting a crafted page or submitting a form), becomes stored in the plugin's data. Subsequent page views by any visitor will execute the injected script in their browser context.

Affected products

10Web Form Maker through 1.15.50

Timeline

2026-11-09: disclosed
2026-10-26: other: reported by xwashira

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.