A stored cross-site scripting vulnerability in the CamaleonCMS contact form plugin enables authenticated attackers to inject malicious scripts, leading to potential account takeover.

The cama_contact_form plugin fails to sanitize user input in the before_html field, allowing a low-privileged authenticated attacker to perform stored cross-site scripting (XSS) attacks.

With a CVSS score of 8.7, this vulnerability poses a significant risk to user session security and data integrity. An attacker can execute malicious scripts in the context of other users, including administrators, which may result in unauthorized data access or complete compromise of the CMS administrative interface.

Immediate Action: Review vendor security advisories for a patch, and if unavailable, disable the cama_contact_form plugin until a fix is released.

Proactive Monitoring: Audit logs for suspicious activity within the contact form edit endpoint and monitor for anomalous HTML content within the application database.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block malicious script injection patterns directed at the contact form management endpoints.

Public Exploit Available: Unknown

Security teams should immediately assess their exposure and consider disabling the vulnerable plugin. Until an official patch is published, restrict access to the contact form configuration to trusted administrative users only.