Vulnerability · Published Aug 12, 2026 · Assigned by VulnCheck

CVE-2026-73332CamaleonCMS cama_contact_form Plugin Stored XSS via before_html Field

High 8.7

In plain English

A high-severity SQL injection in CamaleonCMS from owen2345. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 3.1)8.7High

Exploit odds (30 days)0.4%top 63.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

CamaleonCMS contains a stored cross-site scripting vulnerability in the cama_contact_form plugin that allows low-privileged authenticated attackers to inject arbitrary HTML by submitting unsanitized content to the before_html field through the contact form edit endpoint, which lacks proper authorization controls. Attackers can persist malicious script payloads into the database that execute in victims' browsers when the contact form loads, enabling cookie theft, forged authenticated requests against the admin interface, and session takeover of viewing users.

Affected products (as reported)

Vendor	Product	Versions
owen2345	CamaleonCMS	0 – through 2.9.1

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

References

Product Repository product, patch
Blog Post technical-description
https://www.vulncheck.com/advisories/camaleoncms-cama-contact-form-plugin-stored-xss-via-before-html-field third-party-advisory