CVE-2026-73332 Overview
CVE-2026-73332 is a stored cross-site scripting (XSS) vulnerability in the cama_contact_form plugin shipped with CamaleonCMS. Low-privileged authenticated attackers can inject arbitrary HTML into the before_html field through the contact form edit endpoint. The endpoint lacks proper authorization controls, allowing any authenticated user to modify contact form content. Injected script payloads persist in the database and execute in the browser of any user who loads the affected contact form. Successful exploitation enables cookie theft, forged authenticated requests against the administrative interface, and session takeover of viewing users, including administrators.
Critical Impact
A low-privileged attacker can persist malicious JavaScript that executes in an administrator's browser, leading to full administrative session takeover.
Affected Products
- CamaleonCMS with the cama_contact_form plugin enabled
- Contact form edit endpoint accepting the before_html field
- Deployments where authenticated users of any privilege level can reach the plugin endpoint
Discovery Timeline
- 2026-08-12 - CVE-2026-73332 published to the National Vulnerability Database (NVD)
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-73332
Vulnerability Analysis
The vulnerability resides in the contact form edit handler exposed by the cama_contact_form plugin. The handler accepts a before_html parameter intended to render markup above the form. Server-side code stores the submitted value without sanitizing HTML or JavaScript, and the front-end renders it as raw HTML on subsequent form loads. Because the endpoint does not enforce role-based authorization, any authenticated account, including the lowest-privileged subscriber, can update this field. The result is a stored XSS primitive that fires whenever the contact form is displayed to any visitor or authenticated administrator [CWE-79].
Root Cause
Two defects combine to produce the impact. First, the before_html field is trusted as safe HTML and written to persistent storage without output encoding or allowlist filtering. Second, the contact form edit endpoint is missing an authorization check that would restrict write access to administrators or editors. Either defect alone would be limiting; together they enable persistent script injection by any authenticated principal.
Attack Vector
An attacker authenticates with a low-privileged account and sends a crafted request to the contact form edit endpoint, placing a JavaScript payload inside the before_html parameter. The payload is stored in the CamaleonCMS database. When an administrator or other user later navigates to a page rendering the contact form, the browser executes the payload in the origin's security context. From there the attacker can exfiltrate session cookies, submit forged administrative requests, or pivot to full site compromise.
See the Enrik's Camaleon CMS Vulnerabilities writeup and the VulnCheck Advisory for Camaleon CMS for endpoint-level details.
Detection Methods for CVE-2026-73332
Indicators of Compromise
- Unexpected <script>, <iframe>, or event-handler markup persisted in the before_html column of the CamaleonCMS contact form records.
- HTTP POST or PUT requests to the contact form edit endpoint originating from non-administrative user accounts.
- Administrator sessions issuing unusual API calls shortly after visiting a page that renders a contact form.
- Outbound requests from administrator browsers to unfamiliar domains referenced from CamaleonCMS pages.
Detection Strategies
- Review database contents of contact form records for HTML tags, JavaScript URI schemes, and encoded payloads in the before_html field.
- Correlate web server access logs with user roles to identify low-privileged accounts writing to plugin edit endpoints.
- Enable Content Security Policy (CSP) violation reporting to surface unexpected inline script execution on pages rendering contact forms.
Monitoring Recommendations
- Alert on any modification to cama_contact_form records performed by accounts without administrator or editor roles.
- Monitor administrator session activity for anomalous requests immediately following contact form page loads.
- Track spikes in failed authentication or session reuse from new IP addresses that could indicate cookie theft.
How to Mitigate CVE-2026-73332
Immediate Actions Required
- Disable the cama_contact_form plugin until a patched version is applied.
- Audit and remove any untrusted HTML content already stored in the before_html field.
- Rotate administrator session tokens and force reauthentication for privileged accounts.
- Restrict registration and reduce the number of low-privileged accounts that can reach plugin endpoints.
Patch Information
No vendor-issued patch reference is available in the NVD entry at publication time. Monitor the GitHub Camaleon CMS Repository and the VulnCheck Advisory for Camaleon CMS for fix releases and update guidance.
Workarounds
- Enforce server-side authorization on the contact form edit endpoint so that only administrators can modify plugin content.
- Apply strict HTML sanitization or allowlist encoding to the before_html field before storage and on render.
- Deploy a Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
- Place the CamaleonCMS admin interface behind a web application firewall rule set that blocks HTML tags in the before_html parameter.
# Example CSP header to reduce stored XSS impact
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
