What is the CVSS score of CVE-2026-7232?

CVE-2026-7232 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of FormCraft are affected by CVE-2026-7232?

The FormCraft WordPress plugin (all versions through 3.9.14) contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject persistent malicious scripts…

How to fix or mitigate CVE-2026-7232?

Within 24 hours, inventory all WordPress installations to identify FormCraft deployments and assess whether the plugin is business-critical. Within 7 days, implement interim protections: deploy Web Application Firewall rules targeting matrix field injection patterns, enforce Content Security Policy headers to block inline script execution, and disable FormCraft if alternative form solutions are available. Within 30 days, establish monitoring for vendor security advisories and FormCraft patch releases, maintain an exception register for any retained installations, and plan a 90-day migration timeline if no patch is released.

FormCraft CVE-2026-7232

EUVD-2026-47878 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 Wordfence

GHSA-xr57-33vw-pgmj

PHP WordPress XSS Formcraft

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Unauthenticated network injection (AV:N/AC:L/PR:N), but the stored payload fires only when a victim views the page (UI:R); scope change with low C/I reflects script execution in victims' browser context, no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 06:16 vuln.today

CVE Published

Jul 23, 2026 - 05:35 cve.org

HIGH 7.2

DescriptionCVE.org

The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '[parameter name]' parameter in all versions up to, and including, 3.9.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit chain combines a server-side gap - where composite matrix sub-field keys such as field2_0 and field2_1 are never passed through the sanitization loop and are stored raw via $wpdb->insert() - with a client-side gap where DOMPurify is only invoked when typeof field.value === 'string', but matrix values arrive from the server as arrays, bypassing the check before being mapped to strings and injected into the DOM. Additionally, the same sink is reachable via a second attack vector: array-typed field values are passed through htmlentities() on submission but later reversed by html_entity_decode() at formcraft-main.php:2608 and :2122, restoring the malicious payload before storage and rendering.

Articles & Coverage 2

News 10 New PHP Vulnerabilities - 2 Critical, 8 High, 3 With POC Jul 24, 2026 News 3 New PHP Vulnerabilities - 2 Critical, 1 High Severity Jul 23, 2026

AnalysisAI

Stored cross-site scripting in the FormCraft WordPress plugin (all versions through 3.9.14) lets unauthenticated attackers persist malicious JavaScript that executes in any user's browser when an affected page is rendered. The flaw stems from a two-sided sanitization gap: composite matrix sub-field keys (e.g. field2_0) are written raw via $wpdb->insert(), and the client-side DOMPurify guard is skipped because matrix values arrive as arrays rather than strings. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but its unauthenticated, network-reachable nature (CVSS 7.2) makes it a meaningful patch priority for exposed sites.

Technical ContextAI

The affected component is FormCraft (cpe:2.3:a:formcraft:formcraft), a drag-and-drop form-builder plugin for WordPress written in PHP. The root cause is CWE-79 (improper neutralization of input during web page generation). Two independent code paths reach the same DOM sink: (1) composite matrix sub-field keys such as field2_0 and field2_1 never enter the plugin's sanitization loop and are stored raw in the database; and (2) array-typed field values are encoded with htmlentities() on submission but then reversed by html_entity_decode() at formcraft-main.php lines 2608 and 2122, restoring the original payload before storage and rendering. On the client, DOMPurify is only invoked when typeof field.value === 'string', so array-typed matrix values bypass sanitization before being mapped to strings and injected into the DOM.

RemediationAI

Update FormCraft to a release later than 3.9.14 once the vendor publishes a fixed build; no exact patched version is confirmed in the available data, so consult the vendor changelog at https://formcraft-wp.com/changelog/ and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/6b30089a-2267-47b9-b0a5-d6eeadfe51d2?source=cve to identify the corrected release. Until a patch is applied, reduce exposure by restricting or disabling forms that use composite matrix field types (the specific vector), placing affected forms behind authentication or CAPTCHA to limit anonymous submissions, and deploying a WordPress WAF ruleset (such as Wordfence) to filter script payloads in form submissions; note that disabling matrix fields breaks any form relying on that field type, and WAF filtering can be bypassed and should be treated as a stopgap rather than a fix. Additionally, review the FormCraft submissions table for already-stored payloads, since stored XSS persists in the database even after the code is patched.