CVE-2024-43220
📋 TL;DR
This CVE describes a reflected cross-site scripting (XSS) vulnerability in the Form Maker by 10Web WordPress plugin. Attackers can inject malicious scripts via crafted input that gets reflected in web pages without proper sanitization. WordPress sites using vulnerable versions of this plugin are affected.
💻 Affected Systems
- Form Maker by 10Web WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, perform actions as authenticated users, deface websites, or redirect users to malicious sites.
Likely Case
Attackers trick users into clicking malicious links that execute scripts in their browser, potentially stealing session data or performing limited unauthorized actions.
If Mitigated
With proper input validation and output encoding, malicious scripts would be neutralized before reaching users' browsers.
🎯 Exploit Status
Reflected XSS typically requires user interaction (clicking malicious link) but is straightforward to exploit once the vulnerable parameter is identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.15.27 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Form Maker by 10Web'. 4. Click 'Update Now' if available. 5. Alternatively, download latest version from WordPress repository and manually update.
🔧 Temporary Workarounds
Temporary Plugin Deactivation
allDisable the vulnerable plugin until patched
wp plugin deactivate form-maker
Web Application Firewall (WAF)
allConfigure WAF rules to block XSS payloads targeting form parameters
🧯 If You Can't Patch
- Implement Content Security Policy (CSP) headers to restrict script execution
- Use browser security features like HttpOnly cookies and SameSite attributes
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Form Maker by 10Web version numberCheck Version:
wp plugin get form-maker --field=versionVerify Fix Applied:
Verify plugin version is 1.15.27 or higher after update📡 Detection & Monitoring
Log Indicators:
- Unusual GET/POST requests containing script tags or JavaScript in form parameters
- Multiple failed XSS attempts in web server logs
Network Indicators:
- HTTP requests with suspicious parameters containing <script>, javascript:, or encoded payloads
SIEM Query:
source="web_server_logs" AND ("<script" OR "javascript:" OR "%3Cscript" OR "%22%3E%3Cscript") AND uri_path="*form-maker*"