{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/formcraft-plugin--3.9.14/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-7232"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FormCraft plugin (\u003c= 3.9.14)"],"_cs_severities":["high"],"_cs_tags":["wordpress","xss","plugin","web-application"],"_cs_type":"advisory","_cs_vendors":["FormCraft"],"content_html":"\u003cp\u003eA critical stored Cross-Site Scripting (XSS) vulnerability, identified as CVE-2026-7232, affects the FormCraft plugin for WordPress in all versions up to and including 3.9.14. This flaw enables unauthenticated attackers to inject malicious web scripts into form submissions, which are then stored and executed in users' browsers when they visit pages displaying the injected content. The vulnerability arises from inadequate input sanitization and output escaping. Attackers exploit two primary mechanisms: either by injecting payloads into composite matrix sub-field keys (such as \u003ccode\u003efield2_0\u003c/code\u003e or \u003ccode\u003efield2_1\u003c/code\u003e) which bypass server-side sanitization and are stored raw, or by submitting array-typed field values where initial \u003ccode\u003ehtmlentities()\u003c/code\u003e encoding is later reversed by \u003ccode\u003ehtml_entity_decode()\u003c/code\u003e before storage. Additionally, client-side DOMPurify checks are bypassed as matrix values arrive as arrays, not strings, preventing effective sanitization before being injected into the Document Object Model (DOM).\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated attacker crafts a malicious HTTP POST request containing an XSS payload within a form parameter to a vulnerable FormCraft installation. This payload can target composite matrix sub-field keys (e.g., \u003ccode\u003efield2_0=payload\u003c/code\u003e) or array-typed field values.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eVector 1 (Composite Matrix Keys):\u003c/strong\u003e The FormCraft plugin processes the incoming form data. Specific composite matrix sub-field keys are processed without passing through the intended server-side sanitization routines.\u003c/li\u003e\n\u003cli\u003eThe unsanitized XSS payload from these sub-field keys is directly inserted into the WordPress database via \u003ccode\u003e$wpdb-\u0026gt;insert()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eVector 2 (Array-Typed Values):\u003c/strong\u003e Alternatively, array-typed field values containing an XSS payload are initially encoded using \u003ccode\u003ehtmlentities()\u003c/code\u003e during submission.\u003c/li\u003e\n\u003cli\u003eHowever, during later processing or preparation for storage/rendering, the \u003ccode\u003ehtmlentities()\u003c/code\u003e encoding is reversed by \u003ccode\u003ehtml_entity_decode()\u003c/code\u003e at \u003ccode\u003eformcraft-main.php:2608\u003c/code\u003e and \u003ccode\u003e:2122\u003c/code\u003e, effectively restoring the malicious script.\u003c/li\u003e\n\u003cli\u003eThe restored or unsanitized XSS payload is then stored in the database.\u003c/li\u003e\n\u003cli\u003eWhen a legitimate user accesses a WordPress page or post that displays the stored form submission data, the FormCraft plugin retrieves the malicious content. Client-side DOMPurify, designed for sanitization, is bypassed because the matrix values are rendered as arrays, not strings, preventing the sanitization logic from executing.\u003c/li\u003e\n\u003cli\u003eThe malicious web script is then directly injected into the user's browser DOM and executes in their context, potentially leading to session hijacking, credential theft, or defacement.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-7232 allows unauthenticated attackers to perform stored Cross-Site Scripting (XSS) attacks. This can lead to a range of client-side impacts, including but not limited to, session hijacking, defacement of web pages, redirection to malicious sites, and theft of sensitive user information such as cookies or login credentials. The widespread use of WordPress and the FormCraft plugin means a broad attack surface, with any user accessing an affected page becoming a potential victim of the injected scripts, regardless of their privileges.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-7232 immediately by updating the FormCraft WordPress plugin to version 3.9.15 or later.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026quot;Detect CVE-2026-7232 Exploitation - FormCraft Stored XSS Injection\u0026quot; to your SIEM to identify attempts at injecting malicious scripts through FormCraft forms.\u003c/li\u003e\n\u003cli\u003eMonitor \u003ccode\u003ewebserver\u003c/code\u003e logs for HTTP POST requests to WordPress AJAX or form submission endpoints that contain suspicious XSS payloads in query parameters matching the \u003ccode\u003efieldN_M\u003c/code\u003e pattern described in the attack chain.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-23T06:18:06Z","date_published":"2026-07-23T06:18:06Z","id":"https://feed.craftedsignal.io/briefs/2026-07-formcraft-xss/","summary":"The FormCraft plugin for WordPress, specifically versions up to and including 3.9.14, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability (CVE-2026-7232) that allows unauthenticated attackers to inject arbitrary web scripts into web pages via manipulated form parameters due to insufficient input sanitization and output escaping, leading to script execution in users' browsers when accessing affected pages.","title":"FormCraft WordPress Plugin Stored XSS Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-07-formcraft-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - FormCraft Plugin (\u003c= 3.9.14)","version":"https://jsonfeed.org/version/1.1"}