Stored Cross-Site Scripting Vulnerability in Zero Spam Plugin for WordPress

CVE-2026-96752

What is CVE-2026-96752?

The Zero Spam for WordPress plugin, integrated with Contact Form 7, is susceptible to Stored Cross-Site Scripting due to inadequate sanitization of inputs. This vulnerability allows attackers to insert arbitrary scripts into web pages, which can be executed when other users access those compromised pages. Unsanitized nested POST array keys lead to the persistence of these malicious scripts in the submission logs, enabling exploitation by unauthenticated individuals.

References