CVE-2026-73332

Name of the Vulnerable Software and Affected Versions CamaleonCMS (affected versions not specified)

Description A stored cross-site scripting issue exists in the cama contact form plugin. Low-privileged authenticated attackers can inject arbitrary HTML by submitting unsanitized content to the before html field via the contact form edit endpoint, which lacks proper authorization controls. This allows malicious script payloads to be persisted in the database and executed in the browsers of users who load the contact form, potentially leading to cookie theft, session takeover, and forged authenticated requests against the admin interface.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.