FormCraft CVE-2026-7232

Exploitation requires the target WordPress site to run FormCraft 3.9.14 or earlier with a form that uses composite matrix fields (the sub-field keys such as field2_0/field2_1 that never enter the sanitization loop) or array-typed field values that pass through the htmlentities()/html_entity_decode() round-trip at formcraft-main.php:2608 and :2122. The attacker must reach a publicly accessible form and submit array-structured values, typically by crafting the request directly rather than using the normal UI. Per the CVSS vector (PR:N), no authentication is needed to inject the payload; however, script execution occurs only when a victim subsequently views the page or entry containing the stored payload, and the site must expose a form built with the vulnerable matrix/array field types - forms using only simple string fields are not affected because those values pass through the DOMPurify string check.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) indicates a network-reachable, low-complexity, unauthenticated attack with a scope change reflecting script execution against users separate from the injecting attacker - consistent with stored XSS. There is no EPSS score, SSVC decision, or POC indicator in the supplied intelligence, and the vulnerability is not in CISA KEV, so real-world exploitation is currently unproven. The signal that elevates priority is the unauthenticated (PR:N) precondition combined with persistence: any anonymous visitor able to submit a form can plant a payload that fires against later viewers, including logged-in administrators, which is why the impact metrics carry to Confidentiality and Integrity. On balance this is a genuine but moderate priority - real because it needs no authentication, but bounded because it is XSS (no direct RCE or data-at-rest compromise) and no active exploitation or exploit code is confirmed. Note the UI:N rating: stored XSS typically fires when a victim views the injected page, so treat 'no user interaction' as reflecting attacker-side effort rather than the absence of any victim action - verify against the vendor advisory.

An unauthenticated attacker submits a FormCraft form containing a composite matrix field whose sub-field value carries a JavaScript payload as an array, bypassing both the server-side sanitization loop and the client-side DOMPurify string check so it is stored raw. When an administrator later opens the form entry or a page rendering that submission, the script executes in their authenticated browser session, enabling session hijacking or admin-account takeover. No public exploit code is identified at time of analysis, but the low attack complexity would make weaponization straightforward.