External risk intelligence

CamaleonCMS Contact Form Stored XSS

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-73332

The vulnerability resides in a CMS plugin's contact form, which is often internet-facing. However, exploitation requires authenticated access to the contact form edit endpoint. While the contact form itself is public, the vulnerable administrative/configuration interface is typically restricted to authorized users, making reachability dependent on specific deployment configurations.

SQL Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A stored cross-site scripting vulnerability exists in a CamaleonCMS plugin, allowing authenticated users to inject malicious code that can compromise other users' sessions. This issue affects how user-submitted data is handled within the contact form's settings.

Malicious code can be hidden in contact form settings.
Compromised sessions can lead to unauthorized actions.
Confirm relevance and exposure to user data.

Attack Path

How an attacker could exploit the issue

An attacker with limited access to CamaleonCMS can exploit a vulnerability in the contact form plugin. By submitting specially crafted data to the contact form's edit endpoint, which doesn't adequately check permissions, they can insert malicious code. This code then runs in the browsers of users who view the contact form, potentially allowing the attacker to steal cookies or take over sessions.

Requires authenticated access.
Submit unsanitized data to edit endpoint.
Session takeover and cookie theft.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow attackers to inject malicious code into the contact form, which would then execute in the browsers of users viewing the form. This could lead to the theft of user cookies, the creation of fake requests to the admin interface, and the takeover of sessions for users interacting with the form.

User session data and cookies.
Through unsanitized contact form submissions.
Session hijacking and unauthorized administrative actions.

Operational Fix

Recommended remediation, mitigation, and detection steps

The CamaleonCMS contact form plugin's stored XSS vulnerability likely falls under the purview of application owners and potentially platform teams responsible for CMS management. The immediate practical step is to identify all instances of the CamaleonCMS contact form, confirm their exposure and business criticality, and then assign ownership for remediation planning.

Identify application owners.
Verify public contact form reachability.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is CamaleonCMS and the cama_contact_form plugin?

CamaleonCMS is an open-source content management system built on Ruby on Rails. It uses various plugins to extend functionality, such as cama_contact_form, which allows site administrators to build and manage interactive contact forms for visitors to submit inquiries or feedback directly on a website.

What does CVE-2026-73332 mean by stored cross-site scripting?

This is a security weakness where an application saves malicious scripts provided by a user into its database. Because the site fails to clean this data, the script is served to other users later. In this case, the vulnerability allows an attacker to inject harmful HTML that executes automatically whenever a victim loads the compromised contact form.

How is this vulnerability triggered by an attacker?

An attacker must have low-privileged authenticated access to the contact form's edit settings. The issue is triggered by submitting unsanitized content into the 'before_html' field. Simply visiting the public-facing contact form as a regular user does not trigger the bug; the attacker must be able to interact with the administrative endpoint used to configure the form.

Who should be concerned about this CVE?

Teams managing CamaleonCMS instances should assess their risk. According to Halo Surface Signal, while the contact form itself is often public-facing, the administrative interface required to exploit this is usually restricted. You should prioritize this if you have untrusted or low-privileged users who possess access to modify plugin settings within your CMS.

What should I do first to manage this risk?

Start by identifying all instances of CamaleonCMS within your environment where the contact form plugin is active. Confirm which users have administrative or edit-level permissions for these plugins. Once identified, ensure your team is aware of the access controls protecting your CMS settings and prepare to update or restrict the plugin configuration as part of your maintenance process.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.