Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.2

HT Contact Form plugin for WordPress allows hackers to inject code

CVE-2026-7052 · published 5 months ago
Summary

The HT Contact Form plugin for WordPress is vulnerable to a type of cyber attack called Stored Cross-Site Scripting. This means that hackers can inject malicious code into the plugin's pages, which can then be executed by legitimate users. To protect yourself, update the plugin to the latest version or uninstall it if you don't need it.

Original advisory text
The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'file_upload' parameter in all versions up to, and including, ...
The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'file_upload' parameter in all versions up to, and including, 2.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the 'Store Submissions' setting to be enabled, as this controls whether unsanitized field values are persisted to the database and subsequently rendered via dangerouslySetInnerHTML in the admin entry viewer.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.2 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published28 May 2026
Updated3 Nov 2026
First seen28 May 2026
Sources
CVE-2026-7052 · NVD
Track software like this
Free during beta