CVE-2026-7232: FormCraft WordPress Plugin XSS Vulnerability

CVE-2026-7232 Overview

CVE-2026-7232 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the FormCraft plugin for WordPress. The flaw affects all versions up to and including 3.9.14. Unauthenticated attackers can inject arbitrary JavaScript that executes when users load pages containing the compromised form data.

The root cause is insufficient input sanitization combined with output escaping gaps. Composite matrix sub-field keys such as field2_0 and field2_1 bypass the sanitization loop and reach the database raw through $wpdb->insert(). A parallel decoding gap in formcraft-main.php reverses prior encoding, restoring malicious payloads before storage and rendering.

Critical Impact
Unauthenticated attackers can persistently inject JavaScript into WordPress pages, enabling session theft, credential harvesting, and administrative account takeover.

Affected Products

FormCraft plugin for WordPress — all versions up to and including 3.9.14
WordPress sites with FormCraft forms exposed to public submission
Sites using FormCraft matrix or composite field types

Discovery Timeline

2026-07-23 - CVE-2026-7232 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-7232

Vulnerability Analysis

CVE-2026-7232 is a stored XSS vulnerability that combines server-side and client-side sanitization gaps. FormCraft processes form submissions through a sanitization loop, but composite matrix sub-fields identified by keys such as field2_0 and field2_1 are never routed through that loop. These raw values are written directly to the database through $wpdb->insert().

On the client side, FormCraft calls DOMPurify only when typeof field.value === 'string'. Matrix values arrive from the server as arrays, so the type check fails and DOMPurify is skipped. The array is later mapped to strings and inserted into the DOM, executing any embedded script content.

A second attack vector reaches the same sink. Array-typed field values pass through htmlentities() on submission, but html_entity_decode() reverses that encoding at formcraft-main.php:2608 and formcraft-main.php:2122. The malicious payload is restored to its executable form before storage and rendering.

Root Cause

The vulnerability stems from inconsistent sanitization coverage. The sanitization loop enumerates only top-level field keys and does not descend into composite matrix sub-field keys. The client-side DOMPurify guard uses a strict type check that array payloads bypass.

Attack Vector

An unauthenticated attacker submits a crafted FormCraft form containing malicious script payloads in matrix sub-fields or array-typed fields. The payload is stored raw in the WordPress database. When an administrator or visitor loads a page that renders the stored submission, the injected script executes in the victim's browser context.

See the Wordfence Vulnerability Report for additional technical details on the exploit chain.

Detection Methods for CVE-2026-7232

Indicators of Compromise

Form submission entries in the FormCraft database tables containing <script>, onerror=, onload=, or javascript: substrings within matrix or array field values
Unexpected outbound requests from browser sessions loading FormCraft submission pages
New or modified WordPress administrator accounts created shortly after form submissions
HTML entity sequences that decode into executable JavaScript within stored form data

Detection Strategies

Inspect FormCraft submission tables for payloads targeting matrix sub-field keys matching the pattern field[0-9]+_[0-9]+
Review web server logs for POST requests to FormCraft submission endpoints containing encoded script markers such as <script>
Correlate administrator session anomalies with recent form submission timestamps
Deploy web application firewall rules that inspect POST bodies for script tokens in form field values

Monitoring Recommendations

Audit all FormCraft plugin installations and confirm the running version
Monitor WordPress wp_options and user tables for unauthorized changes following form submissions
Enable file integrity monitoring on formcraft-main.php and related plugin files
Log and alert on Content Security Policy violations originating from pages rendering form submissions

How to Mitigate CVE-2026-7232

Immediate Actions Required

Update the FormCraft plugin to a version later than 3.9.14 as published in the vendor changelog
Audit stored FormCraft submissions for existing script payloads and purge malicious entries
Rotate WordPress administrator credentials and invalidate active sessions if compromise is suspected
Restrict form availability on public pages until patching is complete

Patch Information

Refer to the FormCraft WP Changelog for the fixed release. The patch must address both the server-side sanitization gap for composite matrix sub-fields and the client-side DOMPurify type check, and remove the html_entity_decode() reversal at formcraft-main.php:2608 and formcraft-main.php:2122.

Workarounds

Disable FormCraft forms that use matrix or composite field types until the plugin is updated
Deploy a Content Security Policy that blocks inline script execution on pages rendering form submissions
Add a WAF rule to reject POST payloads containing script tokens targeting matrix sub-field parameters
Restrict form submission endpoints to authenticated users where business requirements allow

bash

# Example WAF rule (ModSecurity) blocking script payloads in FormCraft submissions
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1026723201,\
  msg:'Potential FormCraft CVE-2026-7232 XSS payload'"
  SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:|<script)" \
    "t:none,t:urlDecode,t:htmlEntityDecode"