CVE-2026-96752: Zero Spam for WordPress <= 5.7.10 - Unauthenticated Stored Cross-Site Scripting via Nested POST Array Keys via Contact Form 7 Integration
The Zero Spam for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Nested POST Array Keys via Contact Form 7 Integration in all versions up to, and including, 5.7.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is delivered by submitting a Contact Form 7 request with a nested POST array key containing arbitrary HTML or JavaScript — PHP parses the field name into a nested array key, which is stored verbatim in the zerospamlog.submissiondata column when Zero Spam flags the submission as spam due to the absence of the zerospamdavidwalshkey field.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for exploitation?
The site must use the Contact Form 7 integration, and Zero Spam must flag the submitted request as spam because the zerospam_david_walsh_key field is absent. An unauthenticated attacker can then submit a Contact Form 7 request whose nested POST array key contains HTML or JavaScript.
Who is exposed to the injected script?
The stored payload executes when a user accesses a page that displays the injected content. The available data does not identify which specific user roles or administrative views can access the stored submission details.
How can I determine whether my site is affected?
Sites running Zero Spam for WordPress version 5.7.10 or earlier are affected if they use its Contact Form 7 integration. Review stored Zero Spam spam-submission data for unexpected nested field names containing HTML or JavaScript, particularly submissions flagged because zerospam_david_walsh_key was missing.