Description

The Zero Spam for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Nested POST Array Keys via Contact Form 7 Integration in all versions up to, and including, 5.7.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is delivered by submitting a Contact Form 7 request with a nested POST array key containing arbitrary HTML or JavaScript — PHP parses the field name into a nested array key, which is stored verbatim in the zerospam_log.submission_data column when Zero Spam flags the submission as spam due to the absence of the zerospam_david_walsh_key field.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-25T08:16:42.700Z",
  "pubdate": "2026-09-25T08:16:42.700Z",
  "executiveSummary": "The Zero Spam for WordPress plugin, in versions up to and including 5.7.10, contains a critical Stored Cross-Site Scripting (XSS) vulnerability via the Contact Form 7 integration module.\nThe vulnerability arises from improper handling of nested POST array keys during the submission process. When the plugin identifies a submission as spam, it logs the request data, including the malicious array keys, into the zerospam_log database table without adequate sanitization or output escaping.\nThis vulnerability allows unauthenticated remote attackers to inject arbitrary JavaScript or HTML payloads into the administrative logs. When an administrator or user with appropriate privileges views the submission logs, the malicious payload executes within their browser session.\nThe impact includes potential account takeover, unauthorized administrative actions, and data exfiltration, as the attacker's script executes with the privileges of the victim viewing the logs.\nExploitation is straightforward and does not require prior authentication, as the attack vector involves submitting a crafted form request which is then processed and stored by the vulnerable plugin component.",
  "technicalDetails": "The vulnerability originates from how the Zero Spam plugin processes and stores HTTP POST requests originating from Contact Form 7 integrations. Specifically, the plugin fails to sanitize nested keys within the POST array when processing incoming form submissions.\nWhen a Contact Form 7 submission lacks the required 'zerospam_david_walsh_key' field, the Zero Spam plugin identifies the request as potential spam. Upon this determination, the plugin triggers a logging function that saves the entire structure of the POST request into the 'zerospam_log' database table, specifically within the 'submission_data' column.\nBecause the plugin directly parses PHP array keys from the request, an attacker can supply a malicious payload in the form of a key name. For example, submitting a field name structured as 'test[<script>alert(1)</script>]' forces PHP to parse this as a nested key. The plugin then writes this key verbatim into the database record for the submission.\nThe 'submission_data' column is later retrieved and rendered in the WordPress administrative interface when an administrator views the Zero Spam log entries. Because the stored data is not escaped or sanitized upon output, the browser interprets the injected HTML/JavaScript as legitimate code.\nThe attack flow is as follows: 1) The attacker submits a Contact Form 7 form request with a malicious payload embedded within the key name of the POST array. 2) The plugin detects the absence of the security key and marks the submission as spam. 3) The plugin persists the raw, malicious array key into the 'zerospam_log.submission_data' database column. 4) An administrative user navigates to the Zero Spam logs page. 5) The administrative dashboard displays the log entry, causing the browser to execute the stored JavaScript payload.\nThis flaw persists across all versions up to 5.7.10 and is accessible to any unauthenticated user capable of interacting with the Contact Form 7 plugin instance on the target WordPress site. The successful execution of the payload occurs within the context of the WordPress admin panel, allowing for full client-side compromise of the victim's session."
}