Zero Spam for WordPress <= 5.7.10 - Unauthenticated Stored Cross-Site Scripting via Nested POST Array Keys via Contact Form 7 Integration

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-96752 · Microsoft / collected KEV context

cve-program · CVE-2026-96752

• https://www.wordfence.com/threat-intel/vulnerabilities/id/01540d78-ae46-4556-9a7f-3f8b8dbbcbd7?source=cve
• https://plugins.trac.wordpress.org/browser/zero-spam/tags/5.7.10/includes/templates/admin-modal-details.php#L200
• https://plugins.trac.wordpress.org/browser/zero-spam/tags/5.7.10/modules/contactform7/class-contactform7.php#L85
• https://plugins.trac.wordpress.org/browser/zero-spam/tags/5.7.10/core/class-utilities.php#L65
• https://plugins.trac.wordpress.org/browser/zero-spam/tags/5.7.10/includes/class-db.php#L442
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3709762%40zero-spam&new=3709762%40zero-spam

No related operational record is retained in the current change model.