Vulnerabilities and security researches forht-contactform ht-contactform
Direction: descendingContact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks # CVE-2026-96326
- CVE, Research URL
- Home page URL
-
Security reports for Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks
- Date
- Sep 29, 2026
- Research Description
- The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Rich Text Editor Field in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
max 2.10.3.
- Status
-
vulnerable
Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks # CVE-2026-93303
- CVE, Research URL
- Home page URL
-
Security reports for Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks
- Date
- Sep 25, 2026
- Research Description
- The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'form_data' Rich Text Field via Draft Save/Resume in all versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires tricking a user into clicking an attacker-supplied draft resume URL, which the attacker constructs using the draft_key and access_token returned directly in the save response.
- Affected versions
-
max 2.10.2.
- Status
-
vulnerable
Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks # CVE-2026-14206
- CVE, Research URL
- Home page URL
-
Security reports for Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks
- Date
- Aug 10, 2026
- Research Description
- The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the endpoint that returns a saved form draft, allowing unauthenticated users to read the personal data (name, email, phone, address) stored in form drafts.
- Affected versions
-
max 2.9.3.
- Status
-
vulnerable
Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks # CVE-2026-7052
- CVE, Research URL
- Home page URL
-
Security reports for Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks
- Date
- May 28, 2026
- Research Description
- The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'file_upload' parameter in all versions up to, and including, 2.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the 'Store Submissions' setting to be enabled, as this controls whether unsanitized field values are persisted to the database and subsequently rendered via dangerouslySetInnerHTML in the admin entry viewer.
- Affected versions
-
max 2.8.3.
- Status
-
vulnerable
Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks # CVE-2026-42728
- CVE, Research URL
- Home page URL
-
Security reports for Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks
- Date
- May 27, 2026
- Research Description
- Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Contact Form 7 ht-contactform allows Stored XSS.This issue affects HT Contact Form 7: from n/a through <= 2.8.2.
- Affected versions
-
max 2.8.3.
- Status
-
vulnerable
Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks # CVE-2025-7340
- CVE, Research URL
- Home page URL
-
Security reports for Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks
- Date
- Jul 15, 2025
- Research Description
- The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the temp_file_upload() function in all versions up to, and including, 2.2.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Affected versions
-
max 2.2.2.
- Status
-
vulnerable
Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks # CVE-2025-7341
- CVE, Research URL
- Home page URL
-
Security reports for Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks
- Date
- Jul 15, 2025
- Research Description
- The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the temp_file_delete() function in all versions up to, and including, 2.2.1. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
- Affected versions
-
max 2.2.2.
- Status
-
vulnerable
Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks # CVE-2025-7360
- CVE, Research URL
- Home page URL
-
Security reports for Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks
- Date
- Jul 15, 2025
- Research Description
- The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation in the handle_files_upload() function in all versions up to, and including, 2.2.1. This makes it possible for unauthenticated attackers to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php).
- Affected versions
-
max 2.2.2.
- Status
-
vulnerable
Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks # CVE-2025-54015
- CVE, Research URL
- Home page URL
-
Security reports for Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks
- Date
- Jul 16, 2025
- Research Description
- Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in HT Plugins HT Contact Form 7 ht-contactform allows PHP Local File Inclusion.This issue affects HT Contact Form 7: from n/a through <= 2.0.0.
- Affected versions
-
max 2.1.0.
- Status
-
vulnerable
Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks # CVE-2025-24726
- CVE, Research URL
- Home page URL
-
Security reports for Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks
- Date
- Jan 24, 2025
- Research Description
- Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Contact Form 7 ht-contactform allows Stored XSS.This issue affects HT Contact Form 7: from n/a through <= 1.2.1.
- Affected versions
-
max 1.2.2.
- Status
-
vulnerable
Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks # CVE-2023-0484
- CVE, Research URL
- Home page URL
-
Security reports for Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks
- Date
- Mar 27, 2023
- Research Description
- The Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks WordPress plugin before 1.1.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Affected versions
-
max 1.1.6.
- Status
-
vulnerable