Stored Cross-Site Scripting in CamaleonCMS cama_contact_form Plugin

CamaleonCMS contains a stored cross-site scripting (XSS) vulnerability (CVE-2026-73332) within the cama_contact_form plugin. The vulnerability arises from improper input sanitization and insufficient authorization controls on the contact form edit endpoint. Authenticated attackers with low-level privileges can submit arbitrary HTML and JavaScript payloads into the 'before_html' field, which are stored in the application database without adequate validation. When administrators or other users view the contact form, the injected scripts execute within the context of their browsers. This flaw facilitates the theft of session cookies, the execution of unauthorized administrative operations, and full session hijacking, posing a significant risk to the integrity and confidentiality of the affected CMS environment.

Impact

Successful exploitation allows authenticated attackers to elevate their impact by compromising higher-privileged users. The impact includes unauthorized access to administrative functions, potential data exfiltration via forged authenticated requests, and the persistent execution of malicious code in the browsers of users interacting with the CMS.

Recommendation

• Audit all CamaleonCMS instances for unauthorized modifications to the 'before_html' configuration in contact forms.
• Implement strict server-side input validation and output encoding for all user-controllable fields within the cama_contact_form plugin.
• Review access control lists for the contact form edit endpoint to ensure that only authorized administrative roles can modify form configuration settings.
• Apply patches provided by the CamaleonCMS vendor to address CVE-2026-73332 immediately.