CVE-2026-73332

HIGH 8.7

CamaleonCMS cama_contact_form Plugin Stored XSS via before_html Field

CVSS Score

8.7

EPSS Score

0.0%

EPSS Percentile

0th

CamaleonCMS contains a stored cross-site scripting vulnerability in the cama_contact_form plugin that allows low-privileged authenticated attackers to inject arbitrary HTML by submitting unsanitized content to the before_html field through the contact form edit endpoint, which lacks proper authorization controls. Attackers can persist malicious script payloads into the database that execute in victims' browsers when the contact form loads, enabling cookie theft, forged authenticated requests against the admin interface, and session takeover of viewing users.

CWE	CWE-89
Vendor	owen2345
Product	camaleoncms
Published	Aug 12, 2026
Last Updated	Aug 12, 2026

Stay Ahead of the Next One

Get instant alerts for owen2345 camaleoncms

Be the first to know when new high vulnerabilities affecting owen2345 camaleoncms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

owen2345 / CamaleonCMS

0 ≤ 2.9.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/owen2345/camaleon-cms enrik-m.github.io: https://enrik-m.github.io/posts/Camaleon-CMS-Vulnerabilties/#32-stored-xss-in-contact-form vulncheck.com: https://www.vulncheck.com/advisories/camaleoncms-cama-contact-form-plugin-stored-xss-via-before-html-field

Credits

Amir Aliu & Enrik Mustafa