What is CVE-2026-1065?

CVE-2026-1065 is a high-severity vulnerability in 10web Form Maker By – Mobile-Friendly Drag & Drop Contact Builder, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 7.2/10. Published 2026-02-03.

How severe is CVE-2026-1065?

High severity. CVSS v3 base score is 7.2 out of 10.

Arbitrary file upload in 10web Form Maker By – Mobile-Friendly Drag & Drop Contact Builder

CVE-2026-1065

The Form Maker by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.15.35. This is due to the plugin's default file upload allowlist including SVG files combined with weak substring-based extension validation. This makes it possible for unauthenticated attackers to upload malicious SVG files containing JavaScript code that will execute when viewed by administrators or site visitors via file upload fields in forms granted they can submit forms.

Vulnerability class: Unrestricted File Upload

EPSS: 0.004 (28.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N.

Affected products

10web Form Maker By – Mobile-friendly Drag & Drop Contact Builder — versions 0

Weakness classification (CWE)

CWE-434 — Unrestricted Upload of File with Dangerous Type

References

Frequently asked questions

What is CVE-2026-1065?: CVE-2026-1065 is a high-severity vulnerability in 10web Form Maker By – Mobile-Friendly Drag & Drop Contact Builder, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 7.2/10. Published 2026-02-03.
How severe is CVE-2026-1065?: High severity. CVSS v3 base score is 7.2 out of 10.