CVE-2026-96752

The Zero Spam for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Nested POST Array Keys via Contact Form 7 Integration in all versions up to, and including, 5.7.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is delivered by submitting a Contact Form 7 request with a nested POST array key containing arbitrary HTML or JavaScript — PHP parses the field name into a nested array key, which is stored verbatim in the zerospam_log.submission_data column when Zero Spam flags the submission as spam due to the absence of the zerospam_david_walsh_key field.

• CWE-79

• https://plugins.trac.wordpress.org/browser/zero-spam/tags/5.7.10/core/class-utilities.php#L65
• https://plugins.trac.wordpress.org/browser/zero-spam/tags/5.7.10/includes/class-db.php#L442
• https://plugins.trac.wordpress.org/browser/zero-spam/tags/5.7.10/includes/templates/admin-modal-details.php#L200
• https://plugins.trac.wordpress.org/browser/zero-spam/tags/5.7.10/modules/contactform7/class-contactform7.php#L85
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3709762%40zero-spam&new=3709762%40zero-spam
• https://www.wordfence.com/threat-intel/vulnerabilities/id/01540d78-ae46-4556-9a7f-3f8b8dbbcbd7?source=cve

Published

Sep 25, 2026

Last Modified

Sep 25, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-96747The client-side field level encryption support in the MongoD…5
• CVE-2026-96748PyMongo's connection string parsing decodes percent-encoded …6.5
• CVE-2026-96749An integer overflow in the BSON document encoding component …8.4
• CVE-2026-9675Impact: The undici WebSocket client enforces maxPayloadSize …7.5
• CVE-2026-96750MongoDB Compass can interpolate a database name without esca…7.1
• CVE-2026-96751A vulnerability has been found in pmTicket Project-Managemen…7.3
• CVE-2026-96754orval versions before 8.29.0 contain a code injection vulner…9.8
• CVE-2026-96755orval versions 8.14.0 through 8.28.1 contain a code injectio…9.8
• CVE-2026-96756orval versions before 8.30.0 contain a code injection vulner…8.1
• CVE-2026-96757orval before 8.29.0 fails to escape OpenAPI media-type keys …9.8
• CVE-2026-96758orval @orval/core before 8.28.0 contains a code injection vu…9.8
• CVE-2026-96759orval before 8.29.0 fails to escape the operationId paramete…9.8