CVE-2026-1065
Published: 03 February 2026
Summary
CVE-2026-1065 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 8.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and CM-7 (Least Functionality).
Deeper analysis
CVE-2026-1065 is a stored cross-site scripting (XSS) vulnerability affecting the Form Maker by 10Web plugin for WordPress in all versions up to and including 1.15.35. The issue stems from the plugin's default file upload allowlist permitting SVG files alongside weak substring-based extension validation, enabling the upload of malicious SVG files embedding JavaScript code. This flaw is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) with a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).
Unauthenticated attackers can exploit this vulnerability by submitting forms with file upload fields, uploading SVG files containing executable JavaScript, provided they have access to submit such forms. When administrators or site visitors view the uploaded files, the embedded JavaScript executes in their browsers, potentially leading to session hijacking, defacement, or further compromise depending on the payload.
References include code locations in the plugin's form_maker.php and add_field.js files highlighting the validation weaknesses, a WordPress plugin repository changeset indicating a fix in the trunk (from revision 3440395 to 3447011), and a Wordfence threat intelligence advisory. Mitigation involves updating the plugin to a version beyond 1.15.35, where the allowlist and validation issues are addressed.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5288
Vulnerability details
The Form Maker by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.15.35. This is due to the plugin's default file upload allowlist including SVG files combined with weak substring-based extension…
more
validation. This makes it possible for unauthenticated attackers to upload malicious SVG files containing JavaScript code that will execute when viewed by administrators or site visitors via file upload fields in forms granted they can submit forms.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS via malicious SVG upload directly enables exploitation of public-facing web app (T1190), JavaScript execution (T1059.007), browser session hijacking (T1185), and external defacement (T1491.002).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces strict validation of file types and extensions on form uploads, directly blocking the weak substring-based SVG allowlist that enables malicious file uploads.
Requires malicious code detection mechanisms that can scan or sanitize uploaded SVG files before they are stored and later rendered.
Restricts system functionality to prohibit dangerous file types such as SVG in upload features, eliminating the root cause of the unrestricted upload vector.