Quick answers
- Is CVE-2026-85645 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-85645 being exploited in the wild.
- How severe is CVE-2026-85645?
- Medium severity, with a CVSS score of 6.1, published 10 September 2026.
- Which products and versions are affected?
- 10Web Form Maker up to and including 1.15.46.
- Is there a fix for CVE-2026-85645?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-85645 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-85645?
- Check whether you run 10Web Form Maker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a reflected XSS in the bulk_action parameter of the Submissions_fm.php controller. The parameter is sanitized via sanitize_key() in the execute() method but is later used unsafely in the bulk_action() method without proper output escaping. The code constructs a redirect URL using add_query_arg() and passes unsanitized user input from $_GET that was not included in the delete_keys array. An unauthenticated attacker can send a specially crafted URL to a logged-in admin that reflects malicious JavaScript. The vulnerability affects all versions up to and including 1.15.46. No authentication is required for the initial delivery, but successful exploitation requires social engineering to trick an admin into clicking the malicious link.
Affected products
- 10Web Form Maker up to and including 1.15.46
Timeline
- 2026-09-10: disclosed