An unauthenticated stored Cross-Site Scripting vulnerability in the Form Maker by 10Web plugin allows remote attackers to execute malicious scripts within an administrator's session.

This flaw exists due to insufficient input sanitization and missing output escaping within the plugin's Matrix field. An unauthenticated attacker can submit a crafted form containing malicious JavaScript, which executes when an administrator views the submission in the plugin's dashboard.

Successful exploitation allows an attacker to execute arbitrary code within the context of an administrator's browser session. This can lead to full site compromise, unauthorized administrative actions, or session hijacking. Given the CVSS score of 7.2, this represents a high-severity risk that could lead to significant data loss or unauthorized site management.

Immediate Action: Update the Form Maker by 10Web plugin to the latest version, ensuring it is beyond 1.15.40, to incorporate the necessary input sanitization and output escaping patches.

Proactive Monitoring: Monitor administrative access logs for unusual activity or unauthorized changes made to site configurations or user accounts.

Compensating Controls: Implement a Web Application Firewall with rules configured to detect and block malicious script injection patterns in HTTP POST requests.

Public Exploit Available: Unknown.

The risk posed by this vulnerability is significant due to the potential for administrative account takeover. Administrators should prioritize updating the plugin immediately to the latest patched version. If an immediate update is not feasible, restrict access to the plugin or disable the affected form features until the patch is applied.