CVE-2026-42728

High

Published: 27/05/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The HT Contact Form 7 plugin has a stored XSS vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through 2.8.2.

Risk Assessment

An attacker could exploit this vulnerability to inject malicious scripts, potentially leading to user data theft or session hijacking.

Recommendation

It is recommended to update the HT Contact Form 7 plugin to the latest version to mitigate this vulnerability.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Contact Form 7 ht-contactform allows Stored XSS.This issue affects HT Contact Form 7: from n/a through <= 2.8.2.