Unauthenticated stored cross-site scripting in FormCraft WordPress plugin (CVE-2026-7232)

The FormCraft plugin for WordPress contains a stored cross-site scripting vulnerability affecting all versions up to and including 3.9.14. Unauthenticated attackers can inject arbitrary web scripts via matrix field sub-parameters due to insufficient input sanitization and output escaping, exploitable through two distinct attack vectors: composite matrix sub-field keys stored raw without sanitization, and array-typed field values whose HTML entity encoding is later reversed before storage and rendering. The injected scripts execute in the context of any user who accesses an affected page, posing a risk of session hijacking, credential theft, and unauthorized actions. Affected versions: - <= 3.9.14 We recommend updating to: 3.9.15. CVSS 7.2 · our assessment: this_week Reference: https://www.wordfence.com/threat-intel/vulnerabilities/id/6b30089a-2267-47b9-b0a5-d6eeadfe51d2?source=cve Details: https://vuln.today/cve/CVE-2026-7232