Skip to content
OpenAdvisories

Vendor

HT Plugins

12 known vulnerabilities.

HT Plugins at a glance

Last 12 months
3
Critical · all time
0
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 1 vulnerability March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 1 vulnerability June 2026: 0 vulnerabilities Jun July 2026: 1 vulnerability August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202610
Jun 202600
May 202610
Apr 202600
Mar 202600
Feb 202610
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202520
Aug 202500
Jul 202510
Jun 202530
May 202500
Apr 202500
Mar 202510
Feb 202500
Jan 202520
Dec 202400

Products

HT Contact Form 7 3 HT Mega – Absolute Addons for WPBakery Page Builder 2 Extensions For CF7 2 Insert Headers and Footers Code – HT Script 1 HT Slider For Elementor 1 HT Team Member 1 WishSuite 1 HT Feed 1
All Critical High Medium Low Exploited only Public exploit

12 results · Feed

  • Medium 4.3
    CVE-2026-66474

    WordPress Insert Headers and Footers Code – HT Script plugin <= 1.1.8 - Cross Site Request Forgery (CSRF) vulnerability

    Unauthenticated Cross Site Request Forgery (CSRF) in Insert Headers and Footers Code – HT Script <= 1.1.8 versions.

    HT Plugins Insert Headers and Footers Code – HT Script
  • High 7.1
    CVE-2026-42728

    WordPress HT Contact Form 7 plugin <= 2.8.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Contact Form 7 ht-contactform allows Stored XSS.This issue affects HT Contact Form 7: from n/a through <= 2.8.2.

    HT Plugins HT Contact Form 7
  • Medium 5.3
    CVE-2026-24991

    WordPress Extensions For CF7 plugin <= 3.4.0 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in HT Plugins Extensions For CF7 extensions-for-cf7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Extensions For CF7: from n/a through <= 3.4.0.

    HT Plugins Extensions For CF7
  • Medium 6.5
    CVE-2025-60147

    WordPress HT Feed Plugin <= 1.3.0 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Feed ht-instagram allows Stored XSS.This issue affects HT Feed: from n/a through <= 1.3.0.

    HT Plugins HT Feed
  • Medium 6.5
    CVE-2025-53463

    WordPress HT Mega – Absolute Addons for WPBakery Page Builder Plugin <= 1.0.9 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Mega – Absolute Addons for WPBakery Page Builder ht-mega-for-wpbakery allows DOM-Based XSS.This issue affects HT Mega – Absolute Addons for WPB…

    HT Plugins HT Mega – Absolute Addons for WPBakery Page Builder
  • Medium 6.6
    CVE-2025-54015

    WordPress HT Contact Form 7 plugin <= 2.0.0 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in HT Plugins HT Contact Form 7 ht-contactform allows PHP Local File Inclusion.This issue affects HT Contact Form 7: from n/a through <= 2.0.…

    HT Plugins HT Contact Form 7
  • Medium 6.5
    CVE-2025-53206

    WordPress HT Mega – Absolute Addons for WPBakery Page Builder plugin <= 1.0.8 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Mega – Absolute Addons for WPBakery Page Builder ht-mega-for-wpbakery allows Stored XSS.This issue affects HT Mega – Absolute Addons for WPBake…

    HT Plugins HT Mega – Absolute Addons for WPBakery Page Builder
  • Medium 6.5
    CVE-2025-53199

    WordPress HT Slider For Elementor plugin <= 1.6.5 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Slider For Elementor ht-slider-for-elementor allows DOM-Based XSS.This issue affects HT Slider For Elementor: from n/a through <= 1.6.5.

    HT Plugins HT Slider For Elementor
  • Medium 6.5
    CVE-2025-49309

    WordPress HT Team Member plugin <= 1.1.7 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Team Member ht-team-member allows Stored XSS.This issue affects HT Team Member: from n/a through <= 1.1.7.

    HT Plugins HT Team Member
  • High 7.5
    CVE-2025-30820

    WordPress WishSuite plugin <= 1.4.4 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in HT Plugins WishSuite wishsuite allows PHP Local File Inclusion.This issue affects WishSuite: from n/a through <= 1.4.4.

    HT Plugins WishSuite
  • Medium 6.5
    CVE-2025-24726

    WordPress Contact Form 7 Widget plugin <= 1.2.1 - Stored Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Contact Form 7 ht-contactform allows Stored XSS.This issue affects HT Contact Form 7: from n/a through <= 1.2.1.

    HT Plugins HT Contact Form 7
  • Medium 4.4
    CVE-2025-24695

    WordPress Extensions For CF7 Plugin <= 3.2.0 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in HT Plugins Extensions For CF7 extensions-for-cf7 allows Server Side Request Forgery.This issue affects Extensions For CF7: from n/a through <= 3.2.0.

    HT Plugins Extensions For CF7