CVE-2026-96326
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Rich Text Editor Field in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Risk Assessment
An unauthenticated attacker can execute arbitrary JavaScript in visitors' browsers, potentially leading to session theft, redirects, or administrator account takeover.
Recommendation
Update the HT Contact Form plugin to a version later than 2.10.2, or if not possible, disable the Rich Text Editor field or the entire plugin until the fix is applied.
Other vulnerabilities in HT Contact Form
Original NVD description (English source)
The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Rich Text Editor Field in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS