Zero Spam for WordPress, an anti-spam plugin running on more than 30,000 sites, shipped version 5.7.11 on September 24, 2026 to fix a high-severity stored cross-site scripting bug tracked as CVE-2026-96752. The flaw affects every version up to and including 5.7.10 and lets an unauthenticated attacker plant a working script through the plugin’s Contact Form 7 integration, no login and no admin access needed. If your site runs Zero Spam alongside Contact Form 7, update now.
How the Contact Form 7 Bug Works
The bug sits in how Zero Spam logs submissions it decides are spam. When a Contact Form 7 request arrives without the plugin’s hidden zerospam_david_walsh_key field, Zero Spam flags it as spam and stores the raw submission, field names included, in the zerospam_log.submission_data database column. PHP will parse a field name written as a nested array, something like a bracketed key containing HTML, into an actual nested array key. Zero Spam saved that key as-is, without sanitizing it going in or escaping it coming back out.
That means an attacker doesn’t need an account, a CAPTCHA bypass, or repeated attempts. One crafted form submission is enough to store a script that fires the next time an admin opens the plugin’s detection log inside wp-admin.
Who Is Affected
Wordfence assigned the report a CVSS score of 7.2, high severity, and researcher Adrien Brunner is credited with finding it. Any WordPress site running Zero Spam below 5.7.11 with Contact Form 7 active is exposed, regardless of whether the two plugins are configured to work together on purpose. As of this writing, WPScan hasn’t recorded any public proof-of-concept exploit and the bug isn’t in CISA’s Known Exploited Vulnerabilities catalog, but disclosed WordPress plugin bugs tend to get probed within days, not months. Earlier this month a WordPress core XSS bug in wpautop() followed a similar pattern of quiet disclosure, and it’s the same story with a Forminator Forms vulnerability we covered last month: form-handling code is where a lot of these bugs keep turning up.
What to Do
- Update Zero Spam for WordPress to 5.7.11 or later through your dashboard or WP-CLI as soon as you can.
- If you can’t update immediately, disable Zero Spam’s Contact Form 7 integration in its settings until you do.
- Before you trust any entries already sitting in the plugin’s detection log, check them for stored HTML or script tags rather than opening them straight in wp-admin.
- If you manage several client sites running Zero Spam, patch all of them in the same pass rather than one at a time.
If you’re not sure what else is quietly sitting unpatched in your plugin stack, that’s exactly the kind of thing a WordPress Development audit is built to catch before it becomes a real incident.
