Description

The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'form_data' Rich Text Field via Draft Save/Resume in all versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires tricking a user into clicking an attacker-supplied draft resume URL, which the attacker constructs using the draft_key and access_token returned directly in the save response.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-25T07:16:55.890Z",
  "pubdate": "2026-09-25T07:16:55.890Z",
  "executiveSummary": "The HT Contact Form – Drag & Drop Form Builder for WordPress plugin, in versions up to and including 2.10.1, contains a Stored DOM-Based Cross-Site Scripting (XSS) vulnerability. This flaw arises from inadequate input sanitization and output escaping within the 'form_data' Rich Text Field, specifically during the draft save and resume process.\nThe vulnerability allows an unauthenticated attacker to inject malicious JavaScript into a form's draft state. When a victim views a page containing the maliciously crafted draft data, the script executes within the context of their session.\nThe impact is significant, as it enables unauthorized actions, session hijacking, or the theft of sensitive information. Exploitation is contingent upon the attacker tricking a user into accessing a specific URL containing a draft_key and access_token. Because the plugin returns these tokens in the initial save response, an attacker can craft a persistent malicious payload that triggers upon resumption, posing a high risk to users who interact with the form builder's draft functionality.",
  "technicalDetails": "The root cause of this vulnerability is the failure of the HT Contact Form plugin to properly sanitize user-supplied data submitted to the 'form_data' parameter in its Rich Text Field, combined with a lack of secure output escaping when rendering this data during the draft resume process.\nThe attack flow begins when an unauthenticated attacker interacts with the plugin's draft functionality. By sending a crafted POST request containing malicious JavaScript within the 'form_data' field, the attacker creates a stored draft. The server responds with a draft_key and access_token. These two parameters are critical to the exploitation process, as they allow an attacker to reconstruct a URL that triggers the rendering of the malicious payload.\nThe vulnerability is DOM-Based because the application's client-side code improperly handles the data retrieved via the draft resume mechanism. When a victim clicks an attacker-supplied link—a URL constructed using the stolen or guessed draft_key and access_token—the plugin's frontend component retrieves the stored malicious 'form_data' from the server and injects it into the Document Object Model (DOM) without sufficient neutralization of potential script tags.\nBecause the payload is stored server-side as part of the draft, it remains persistent until the draft is deleted. When a victim accesses the resumed form, the browser parses the injected script as valid JavaScript, executing it with the victim's privileges in the context of the vulnerable WordPress site. This behavior facilitates a variety of post-exploitation scenarios, including the manipulation of the current document, redirection of the user, exfiltration of authentication cookies, or performing actions on behalf of the victim through authenticated AJAX requests.\nThe vulnerability is exploitable by unauthenticated attackers, provided they can influence the user to interact with the crafted resume URL. The lack of validation on the data returned from the draft save response ensures that arbitrary scripts are persisted and subsequently reflected in the browser whenever the draft is rendered, bypassing standard security filters that might only be applied to static form submissions rather than dynamic draft states."
}