Stored Cross-Site Scripting Vulnerability in CamaleonCMS Contact Form Plugin
CVE-2026-73332

9.2CRITICAL

Key Information:

Vendor

Owen2345

Status
Camaleoncms
Vendor
CVE Published:
12 August 2026

What is CVE-2026-73332?

A stored cross-site scripting vulnerability exists in the cama_contact_form plugin of CamaleonCMS that allows attackers with low privileges to inject arbitrary HTML and JavaScript code. Attackers can exploit this flaw by submitting unsanitized input into the before_html field via the contact form edit endpoint. This vulnerability lacks sufficient authorization controls, enabling attackers to persist malicious scripts in the database. When the contact form is accessed by users, these scripts execute within their browsers, leading to potential cookie theft, unauthorized administrative actions, and session hijacking.

Affected Version(s)

CamaleonCMS 0 <= 2.9.1

References

https://github.com/owen2345/camaleon-cms
productpatch
https://enrik-m.github.io/posts/Camaleon-CMS-Vulnerabilti...
technical-description
https://www.vulncheck.com/advisories/camaleoncms-cama-con...
third-party-advisory

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Amir Aliu & Enrik Mustafa
.