CVE-2026-96326: HT Contact Form – Drag & Drop Form Builder for WordPress <= 2.10.2 Unauthenticated Stored Cross-Site Scripting via Rich Text Editor Field
The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Rich Text Editor Field in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker can exploit the vulnerable Rich Text Editor Field. No authentication or user interaction is required to inject the malicious script.
When does the injected script execute, and who may be affected?
The script executes whenever a user accesses a page containing the injected content. This can affect any user who visits the affected page, including higher-privileged WordPress users.
Which plugin versions are affected?
All versions up to and including 2.10.2 are affected. The provided data does not identify a fixed version.