Description

The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Rich Text Editor Field in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-29T02:16:55.957Z",
  "pubdate": "2026-09-29T02:16:55.957Z",
  "executiveSummary": "The HT Contact Form – Drag & Drop Form Builder for WordPress plugin contains a critical Stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 2.10.2.\nThis vulnerability stems from inadequate sanitization and output escaping within the Rich Text Editor (RTE) field component.\nThe flaw allows unauthenticated remote attackers to inject malicious JavaScript into form submissions, which is subsequently rendered by the application when an administrator or user views the form data.\nThe primary impact involves the execution of unauthorized scripts in the context of the victim's session, potentially leading to unauthorized administrative actions, credential theft, session hijacking, or unauthorized content modification.\nThe vulnerability is particularly severe as it requires no prior authentication to exploit, exposing the site to public-facing attack vectors via standard form submissions.\nImmediate remediation is required to prevent the exploitation of stored payloads within the WordPress dashboard or public pages.",
  "technicalDetails": "The vulnerability originates from a failure to perform adequate server-side input sanitization and context-aware output encoding on data processed through the Rich Text Editor Field component of the HT Contact Form plugin.\nThe component fails to strip dangerous HTML tags or neutralize JavaScript event handlers when processing input submitted via form fields.\nAttackers exploit this by crafting a malicious payload containing script tags (e.g., <script>alert(document.cookie)</script>) or event handler attributes (e.g., onerror, onload) within the input field.\nWhen the form is submitted, the malicious payload is saved directly into the WordPress database without restriction.\nThe exploitation flow proceeds as follows: First, an unauthenticated attacker submits a form entry containing the malicious payload via the publicly accessible form interface. Second, the plugin backend processes the input, storing the raw HTML/script string in the database. Third, when a privileged user, such as an administrator, accesses the WordPress dashboard to review form submissions, the application fetches the stored data and renders it within the browser.\nBecause the output is rendered without proper escaping, the browser interprets the injected payload as legitimate markup, executing the script within the authenticated context of the administrator's session.\nThis allows for post-exploitation activities such as exfiltrating CSRF tokens, forcing the administrator to perform malicious actions (such as creating new administrative accounts), or redirecting users to external malicious domains.\nThe vulnerability is categorized as Stored XSS due to the persistence of the payload, ensuring the script triggers every time the affected submission is loaded or viewed.\nThe scope of affected versions includes all iterations through 2.10.2, and there are currently no privilege or authentication prerequisites for the injection phase, making the attack surface fully exposed to any user capable of interacting with the plugin's form builder or submission interface."
}