CVE-2026-7232 FormCraft CVE debrief

Who should care

Users of the FormCraft plugin for WordPress, particularly those with versions up to and including 3.9.14, should be aware of this vulnerability and take steps to mitigate it. This includes updating the plugin to a version beyond 3.9.14 and implementing additional input validation and output escaping measures. Operational impact could include the injection of arbitrary web scripts into pages, potentially leading to unauthorized actions or data breaches. Vulnerability management and security teams should prioritize this issue due to its high CVSS score of 7.2 and the potential for unauthenticated attacks.

Technical summary

The vulnerability in the FormCraft plugin for WordPress is a Stored Cross-Site Scripting (XSS) issue that affects versions up to and including 3.9.14. It is caused by insufficient input sanitization and output escaping in the handling of certain parameters. The exploit involves a combination of server-side and client-side vulnerabilities. Server-side, composite matrix sub-field keys are stored raw without passing through the sanitization loop, utilizing $wpdb->insert(). Client-side, DOMPurify is only invoked for string values, not for array-typed field values which are received from the server as arrays, mapped to strings, and then injected into the DOM without proper protection. A secondary attack vector exists where array-typed field values, though passed through htmlentities() upon submission, are later restored to their original form via html_entity_decode() before storage and rendering, allowing for the injection of malicious scripts.

Defensive priority

High priority due to CVSS score of 7.2 and potential for unauthenticated attacks.

Recommended defensive actions

• Update FormCraft plugin to a version beyond 3.9.14
• Implement additional input validation and output escaping measures
• Monitor for suspicious activity and injected scripts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The evidence from the CVE record and NVD detail indicate a high severity vulnerability with potential for significant impact. The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '[parameter name]' parameter in all versions up to, and including, 3.9.14 due to insufficient input sanitization and output escaping. The exploit chain combines a server-side gap — where composite matrix sub-field keys such as field2_0 and field2_1 are never passed through the sanitization loop and are stored raw via $wpdb->insert() — with a client-side gap where DOMPurify is only invoked when typeof field.value === 'string', but matrix values arrive from the server as arrays, bypassing the check before being mapped to strings and injected into the DOM. Additionally, the same sink is reachable via a second attack vector: array-typed field values are passed through htmlentities() on submission but later reversed by html_entity_decode() at formcraft-main.php:2608 and :2122, restoring the malicious payload before storage and rendering. Defenders should verify the presence of affected product deployments in managed environments and review official advisories for scope, severity, and guidance.

Official resources