CVE-2026-73332: High Stored XSS in CamaleonCMS Contact Form

CVE-2026-73332 is a stored cross-site scripting flaw in the CamaleonCMS contact form plugin. A low privilege user can save script into the before_html field through an endpoint with no proper authorization. The record scores it 8.7, High. VulnCheck lists 2.9.1 and earlier as affected, and no fix is confirmed.

What's affected

VulnCheck lists CamaleonCMS 2.9.1 and earlier as affected. The record gives no versions. We did not find a fixed release in the sources we read, so check the project repository and release notes. Do not assume that a newer version is safe.

The flaw is in the cama_contact_form plugin. The record says a low privilege authenticated user can submit unsanitized content to the before_html field through the contact form edit endpoint, which lacks authorization checks. The content is saved in the database and runs in the browser of anyone who loads the form. The record lists the effects as cookie theft, forged requests against the admin interface and session takeover of people who view the form. It also appears as the second half of a chain with CVE-2026-73326, which covers the missing authorization on plugin settings.

There is a conflict in the record. It lists the weakness as CWE-89, SQL injection, while the description and VulnCheck's own title describe stored cross-site scripting, which is normally filed as CWE-79. The description is the better guide to the real problem. The CWE label looks like a data entry mistake.

How to check if you're exposed

Find out whether you run CamaleonCMS and which version.

bundle list | grep camaleon_cms

If the gem is at 2.9.1 or lower, you are in the range VulnCheck lists. Then check whether you use the contact form plugin on any site. If you do, inspect the before_html value of each form in the admin interface. Anything other than plain markup you wrote yourself is suspicious. Also review who holds accounts, since the attacker needs a login. The free in-browser scan at gold.safeguard.sh/scan accepts a manifest and lists known CVEs for the packages it finds.

What to do now

1. Check the CamaleonCMS repository for a fixed release and upgrade when one is confirmed.
2. Inspect the before_html field of every contact form and clean out anything you did not write.
3. Remove unneeded low privilege accounts and turn off open registration.
4. Add a Content Security Policy header that limits inline script, to reduce the impact of stored script.
5. Mark session cookies as HttpOnly and Secure so that script cannot read them.
6. Apply the controls for CVE-2026-73326 at the same time, since the two flaws chain.

Why it matters

Stored script injection is dangerous because it runs in other people's sessions. The attacker writes once, and every administrator or visitor who loads the form runs the content. When the same attacker can also change plugin settings without authorization, the path from a low privilege account to an administrator session is short.

The sources differ on severity. The record scores it 8.7 High under CVSS 3.1 with a changed scope. VulnCheck lists it as critical at 9.2 under CVSS 4.0. Take the higher view if you let outside users register. The CWE conflict noted above does not change what to do. No source says the flaw has been exploited in the wild, and the CVE is not on the CISA KEV list.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• VulnCheck advisory
• CamaleonCMS repository
• Researcher write up

Last reviewed: 18 October 2026.