CVE-2026-4388

High

Published: 14 April 2026

Published

14 April 2026

Modified

22 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

EPSS Score 0.0013 32.4th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-4388 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2026-4388 is a stored cross-site scripting (XSS) vulnerability in the Form Maker by 10Web plugin for WordPress, affecting all versions up to and including 1.15.40. The flaw occurs in the Matrix field with Text Box input type during form submissions, stemming from insufficient input sanitization using `sanitize_text_field`, which removes HTML tags but preserves quotes, combined with a lack of output escaping when displaying submission data in the admin Submissions view. This CWE-79 issue has a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), indicating high severity due to its network accessibility and scope change.

Unauthenticated attackers can exploit this vulnerability by submitting a malicious form with JavaScript payloads in the Matrix field's Text Box input. When a site administrator views the submission details in the admin panel, the injected script executes in their browser context, potentially enabling theft of admin session cookies, keystroke logging, or further site compromise such as account takeover.

Mitigation requires updating the Form Maker plugin to a version newer than 1.15.40, where the issue is addressed via changes visible in the WordPress plugin repository's changeset between revisions 3492680 and 3501693. Affected code locations include admin/views/FormMakerSubmits.php lines 166 and 169, and frontend/models/form_maker.php line 2352. Additional details are available in the Wordfence threat intelligence report.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-22199

Vulnerability details

The Form Maker by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Matrix field (Text Box input type) in form submissions in all versions up to, and including, 1.15.40. This is due to insufficient input sanitization…

(`sanitize_text_field` strips tags but not quotes) and missing output escaping when rendering submission data in the admin Submissions view. This makes it possible for unauthenticated attackers to inject arbitrary JavaScript through a form submission that executes in the browser of an administrator who views the submission details.

CWE(s): CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.007 JavaScript Execution

Adversaries may abuse various implementations of JavaScript for execution.

attack.mitre.org →

Why these techniques?

Stored XSS in public-facing WordPress plugin allows unauthenticated form submission of JS payloads that execute in admin browser context on viewing submissions, directly mapping to public app exploitation and JavaScript interpreter execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1