CVE-2026-96326 in HT Contact Form Plugin
Summary
by MITRE • 09/29/2026
The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Rich Text Editor Field in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The HT Contact Form – Drag & Drop Form Builder plugin for WordPress contains a critical security flaw identified as Stored Cross-Site Scripting, which affects all versions up through 2.10.2. This vulnerability stems from insufficient input sanitization and output escaping mechanisms within the Rich Text Editor Field functionality of the plugin. The core technical issue lies in the failure to properly validate or encode user-supplied data before it is stored in the database and subsequently rendered back into web pages without adequate protection against script injection. Because the flaw resides in a feature accessible via the administrative interface, an attacker with minimal privileges can exploit this weakness by crafting malicious content that persists on the server side rather than being transiently passed through URL parameters or headers.
The operational impact of this vulnerability is severe due to its stored nature and unauthenticated accessibility vector for certain configurations or if privilege escalation occurs during initial setup phases where default credentials might be weak. Once an attacker successfully injects arbitrary web scripts into a page managed by the HT Contact Form plugin, these malicious payloads execute automatically whenever any user accesses the affected page. This execution context allows attackers to perform actions such as stealing session cookies, hijacking administrative sessions, defacing websites, or redirecting users to phishing sites designed to harvest sensitive information like login credentials and personal data. The persistence of the payload means that every visitor to the compromised page becomes a potential victim without needing any further interaction from the attacker after the initial injection.
From an industry standards perspective, this vulnerability aligns with CWE-79, which classifies Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism involves stored XSS where malicious scripts are permanently stored within target servers, such as in a database or comment field, and then served to other users without proper sanitization. In terms of the MITRE ATT&CK framework for enterprise security, this behavior maps to techniques under Taint Analysis failures leading to Injection attacks, specifically falling under Execution via Web Shell or Scripting Interpreter contexts if the script performs further actions on the server side. It also relates to Credential Access through Browser Session Hijacking when session tokens are stolen due to cookie access enabled by the injected JavaScript code running in the victim's browser with elevated privileges.
Mitigation strategies must prioritize immediate remediation and ongoing security hygiene. The most effective solution is to upgrade the HT Contact Form plugin to version 2.10.3 or later, where developers have addressed these sanitization and escaping deficiencies. For organizations unable to update immediately due to compatibility concerns, temporary mitigations include implementing a Web Application Firewall rule set that detects and blocks common XSS payloads in POST requests targeting form builder endpoints. Additionally, administrators should enforce strict Content Security Policy headers on their WordPress sites to restrict the execution of inline scripts unless explicitly whitelisted, thereby neutralizing many stored XSS attacks even if they bypass input validation. Regular security audits using static application security testing tools can help identify similar vulnerabilities across other plugins by ensuring that all user inputs are consistently sanitized and output encoded according to OWASP guidelines before being rendered in HTML contexts.