Skip to content
OpenAdvisories

Vendor

htplugins

15 known vulnerabilities.

Products

HT Contact Form – Drag & Drop Form Builder for WordPress 6 Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) 2 Insert Headers and Footers Code – HT Script 2 Docus – YouTube Video Playlist 1 HT Slider For Elementor 1 WishSuite – Wishlist for WooCommerce 1 WP Team – WordPress Team Member Plugin 1 HT Easy GA4 – Google Analytics WordPress Plugin 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.2
    CVE-2026-96326

    HT Contact Form – Drag & Drop Form Builder for WordPress <= 2.10.2 Unauthenticated Stored Cross-Site Scripting via Rich Text Editor Field

    The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Rich Text Editor Field in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escapi…

    htplugins HT Contact Form – Drag & Drop Form Builder for WordPress Web / CMS
  • High 7.2
    CVE-2026-93303

    HT Contact Form <= 2.10.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'form_data' Rich Text Field via Draft Save/Resume

    The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'form_data' Rich Text Field via Draft Save/Resume in all versions up to, and including, 2.10.1 due to insufficient inp…

    htplugins HT Contact Form – Drag & Drop Form Builder for WordPress Web / CMS
  • High 7.2
    CVE-2026-7052

    HT Contact Form <= 2.8.2 - Unauthenticated Stored Cross-Site Scripting via File Upload Field

    The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'file_upload' parameter in all versions up to, and including, 2.8.2 due to insufficient input sanitization and output escapi…

    htplugins HT Contact Form – Drag & Drop Form Builder for WordPress Web / CMS
  • High 8.1
    CVE-2025-7645

    Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.2.8 - Unauthenticated Arbitrary File Deletion Triggered via Admin Form Submission Deletion

    The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete-file' field in all versions up to, and including, 3.2.8.…

    htplugins Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) Web / CMS