HT Contact Form: Unauthenticated stored XSS through Rich Text Editor submissions
HT Contact Form through 2.10.2 accepts attacker-controlled content through the Rich Text Editor field without adequate input sanitization and output escaping. An unauthenticated visitor can submit script-bearing rich text that is stored and later rendered as active browser content when a user views an affected page. This permits script execution in the site's origin; the export does not establish a particular victim role or guaranteed administrator account takeover. The field type is disclosed, but the submission endpoint, request parameter, storage location and rendering function are unspecified. The official changelog confirms a matching fix in 2.10.3.
- Component
- HT Contact Form – Drag & Drop Form Builder for WordPress
- Plugin slug
ht-contactform- Affected
- <= 2.10.2
- Safe version
2.10.3- Published
- Sep 29, 2026
This CVE was published Sep 29, 2026 and is one of 10 known issues for this plugin.
Update, patch or deactivate.
Update to 2.10.3 or a later supported release. The official 2.10.3 changelog specifically fixes stored XSS in the Rich Text Editor field reachable through unauthenticated form submissions; the earlier 2.10.2 entry concerns the distinct Save & Resume draft flow and is not the fix for this CVE. Until updated, disable affected rich-text forms or deactivate the component. An application-level fix should enforce a server-side allowlist for permitted rich-text HTML and safely render stored values in their output context. Review and remove persisted malicious submissions before reopening the affected views; client-side editor restrictions alone are insufficient.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Rich Text Editor Field in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N