CVE-2026-73332 is a stored XSS in CamaleonCMS's contact form plugin, but framing it as a 'forgotten sanitization' miss treats the symptom, not the disease. The real failure is architectural: the CMS's plugin model decoupled the rendering context from the security guarantee, delegating sanitization responsibility to plugin authors who lack the tooling, workflow support, or organizational context to implement it consistently.
The before_html field carries an implicit contract—content bearing this name renders as raw HTML before a form. The framework created the field, named it for its intended purpose, and then left sanitization to the plugin author. That's not developer negligence; it's a system design failure. There's no scaffold in the CMS that warns authors when a field with an _html suffix lacks sanitization, no opt-in model for raw rendering, no regression test infrastructure catching these gaps.
Compounding this: the edit endpoint accepts arbitrary field updates through mass assignment without capability checks scoped to field types. A low-privilege authenticated user modifying configuration fields that render unescaped in an admin context represents an authorization failure at the API design level. The endpoint operates on field names rather than understanding field semantics—it doesn't know before_html carries HTML content; it just processes key-value pairs.
The broader pattern matters more than this single field. The _html suffix naming convention itself is a vulnerability attractor—it signals to developers that content is 'HTML-ready' rather than 'HTML-unsafe and requires wrapping.' This pattern has reproduced across CMS genealogies (WordPress, Drupal, Concrete5, OctoberCMS) for fifteen years. The fix requires more than patching this field: audit your plugin ecosystem for other *_html fields with the same birth defect, implement field-type-aware authorization that distinguishes trusted configuration from user content, and strongly consider renaming raw HTML fields to make the security contract explicit rather than implicit.