CVE-2026-93303 in HT Contact Form Plugin
Summary
by MITRE • 09/25/2026
The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'form_data' Rich Text Field via Draft Save/Resume in all versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires tricking a user into clicking an attacker-supplied draft resume URL, which the attacker constructs using the draft_key and access_token returned directly in the save response.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/25/2026
The HT Contact Form – Drag & Drop Form Builder for WordPress plugin contains a critical security flaw classified as Stored DOM-Based Cross-Site Scripting within its form data handling mechanisms. This vulnerability exists specifically in versions up to 2.10.1 and stems from insufficient input sanitization and output escaping when processing the rich text field associated with form_data during draft save or resume operations. The core technical failure lies in the application's inability to properly validate and encode user-supplied content before it is stored and subsequently rendered back into the browser environment via JavaScript execution contexts. This lack of rigorous data validation allows malicious actors to inject arbitrary web scripts that persist within the system until they are triggered by a victim user accessing the compromised page or form draft.
From an operational perspective, this vulnerability enables unauthenticated attackers to execute client-side code without requiring any prior authentication credentials. The exploitation chain relies on social engineering tactics where the attacker constructs a specific URL containing parameters such as draft_key and access_token which are returned directly in the save response of the plugin's API or interface. By tricking an administrator or authorized user into clicking this crafted link, the attacker ensures that when the form is loaded for editing or viewing, the injected script executes within the context of the victim's session. This can lead to severe consequences including account hijacking through cookie theft, redirection to malicious sites, defacement of the website interface, or further propagation of malware across the network if combined with other client-side exploits.
The nature of this flaw aligns closely with Common Weakness Enumeration identifiers such as CWE-79 for Improper Neutralization of Input During Web Page Generation and CWE-83 for Cross-site Scripting in a DOM-based Environment. Furthermore, from an adversary tactics perspective, the exploitation method corresponds to ATT&CK technique T1059 which covers Command and Scripting Interpreter execution via browser scripts like JavaScript or VBScript. The persistence aspect is notable because while it is technically stored within the draft data structure, its activation requires user interaction with a specific URL constructed by the attacker, making it a hybrid of storage-based and reflected XSS vectors depending on how the frontend framework processes the DOM elements upon loading the form builder interface.
Mitigation strategies must prioritize immediate patching to version 2.10.2 or later where these sanitization issues have been addressed by the developers. In environments where upgrading is not immediately feasible, administrators should implement strict Content Security Policy headers that restrict script execution sources and disable inline scripts if possible. Additionally, input validation rules should be enforced at both the client-side JavaScript level and server-side PHP processing layers to ensure that only expected HTML tags are permitted in rich text fields while all other potentially dangerous characters are escaped or removed. Regular security audits of third-party WordPress plugins are essential to identify similar patterns of insufficient output encoding before they can be exploited by malicious actors targeting high-privilege users within the administrative dashboard.