CVE-2026-73332: critical vulnerability in owen2345 CamaleonCMS
CamaleonCMS cama_contact_form Plugin Stored XSS via before_html Field
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.2epss 0.4%
CamaleonCMS contains a stored cross-site scripting vulnerability in the cama_contact_form plugin that allows low-privileged authenticated attackers to inject arbitrary HTML by submitting unsanitized content to the before_html field through the contact form edit endpoint, which lacks proper authorization controls. Attackers can persist malicious script payloads into the database that execute in victims' browsers when the contact form loads, enabling cookie theft, forged authenticated requests against the admin interface, and session takeover of viewing users.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Affected products
owen2345 · CamaleonCMSRelated CVEs — owen2345 CamaleonCMS
In the same product, most dangerous first.
CVE-2026-73330HIGHCamaleonCMS 2.9.1 Server-Side Template Injection via test_email ActionEPSS 0.8%CVE-2026-56721HIGHCamaleonCMS 2.9.2 Privilege Escalation via Parameter Confusion in UsersControllerEPSS 0.5%CVE-2026-73329CRITICALCamaleonCMS Stored XSS via Draft Post Title Creation EndpointEPSS 0.4%CVE-2026-73326HIGHCamaleonCMS Missing Authorization via Plugin Administration EndpointsEPSS 0.4%CVE-2026-73331HIGHCamaleonCMS 2.9.1 Authenticated SQL Injection via Post Slug FieldEPSS 0.4%CVE-2026-56720MEDIUMCamaleonCMS 2.9.2 and earlier Missing Authorization via profile ActionEPSS 0.3%