CVE-2026-96813Published
Form Maker by 10Web <= 1.15.47 - Unauthenticated Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-96813 · Microsoft / collected KEV context
cve-program · CVE-2026-96813
- https://www.wordfence.com/threat-intel/vulnerabilities/id/87fa5b87-1b32-4d00-8b43-fd51416d3099?source=cve
- https://plugins.trac.wordpress.org/browser/form-maker/tags/1.15.47/admin/views/FMMapEditinPopup.php#L35
- https://plugins.trac.wordpress.org/browser/form-maker/tags/1.15.47/admin/controllers/FormMakerMapEditinPopup.php#L31
- https://plugins.trac.wordpress.org/browser/form-maker/tags/1.15.47/admin/views/Submissions_fm.php#L626
- https://plugins.trac.wordpress.org/browser/form-maker/tags/1.15.47/frontend/models/form_maker.php#L1651
- https://plugins.trac.wordpress.org/browser/form-maker/tags/1.15.47/framework/WDW_FM_Library.php#L366
- https://plugins.trac.wordpress.org/browser/form-maker/tags/1.15.44/admin/views/FMMapEditinPopup.php#L35
- https://plugins.trac.wordpress.org/browser/form-maker/tags/1.15.44/admin/controllers/FormMakerMapEditinPopup.php#L31
- https://plugins.trac.wordpress.org/browser/form-maker/tags/1.15.44/admin/views/Submissions_fm.php#L626
- https://plugins.trac.wordpress.org/browser/form-maker/tags/1.15.44/frontend/models/form_maker.php#L1651
- https://plugins.trac.wordpress.org/browser/form-maker/tags/1.15.44/framework/WDW_FM_Library.php#L366
- https://plugins.trac.wordpress.org/changeset?reponame=&new=3716589%40form-maker%2Ftags%2F1.15.48&old=3686568%40form-maker%2Ftags%2F1.15.47
- https://plugins.trac.wordpress.org/changeset/3716587/form-maker/trunk/admin/views/FMMapEditinPopup.php
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.