CVE-2026-7232

Name of the Vulnerable Software and Affected Versions FormCraft versions prior to 3.9.15

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when accessed by a user. The issue stems from a server-side gap where composite matrix sub-field keys, such as field2 0 and field2 1, bypass the sanitization loop and are stored raw via the $wpdb->insert() function. On the client side, DOMPurify is only triggered for string values, while matrix values are received as arrays, bypassing the check before being injected into the DOM. A second vector exists where array-typed field values are processed by htmlentities() upon submission but are subsequently reversed by html entity decode() in formcraft-main.php at lines 2608 and 2122, restoring the payload before storage and rendering.

Recommendations Update FormCraft to version 3.9.15 or later.