Junglewise Threat Intelligence

CVE-2026-7052: HT Plugins HT Contact Form Stored XSS in file_upload parameter

CVE-2026-7052 · Severity: high · CVSS 7.2 · Published 2026-05-28

Executive brief

The HT Contact Form plugin for WordPress, used to create custom contact forms, contains a security flaw that allows unauthenticated visitors to inject malicious scripts into the website. If the 'Store Submissions' feature is enabled, these scripts are saved in the database and triggered when an administrator views form entries. This could lead to unauthorized actions being performed on behalf of the administrator, such as account takeover or site modification.

Technical details

The HT Contact Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'file_upload' parameter in versions up to 2.8.2. The root cause is insufficient input sanitization and output escaping of user-submitted data. When the 'Store Submissions' setting is enabled, malicious payloads are persisted to the database and later rendered in the admin entry viewer using the dangerouslySetInnerHTML function. An unauthenticated attacker can exploit this by submitting a crafted form entry, which executes arbitrary JavaScript in the context of an administrator's session when they view the submission. A patch appears to be available in the latest trunk/version updates.

Affected products

  • HT Plugins HT Contact Form – Drag & Drop Form Builder for WordPress Up to and including 2.8.2

Timeline

  • 2026-05-28: disclosed: Initial publication of the vulnerability details.
  • 2026-05-28: advisory: Wordfence published the vulnerability advisory.

References