CVE-2026-96752

Name of the Vulnerable Software and Affected Versions Zero Spam for WordPress versions prior to 5.7.11

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS). This occurs through the Contact Form 7 integration when a request is submitted with a nested POST array key containing arbitrary HTML or JavaScript. PHP parses the field name into a nested array key, which is then stored verbatim in the zerospam log.submission data column if the submission is flagged as spam due to the missing zerospam david walsh key field. This allows the injection of web scripts that execute when a user accesses the affected page.

Recommendations Update to a version newer than 5.7.10.