CVE-2026-7052

Vulnerability

The HT Contact Form – Drag & Drop Form Builder for WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.8.2. The vulnerability resides in the file_upload parameter processed by the submit_form callback in admin/Includes/Api/Endpoints/Submission.php [1][2]. Insufficient input sanitization and output escaping allow arbitrary JavaScript to be injected. The flaw is only exploitable when the "Store Submissions" setting is enabled, which persists form data to the database [1]. The REST endpoint /submission is publicly accessible with no authentication required (check_permission returns true) [3].

Exploitation

An unauthenticated attacker can send a POST request to the /submission REST endpoint with a crafted file_upload parameter containing XSS payloads. No prior authentication or special privileges are needed [3]. The attacker must ensure that the site has the "Store Submissions" setting active, as this is required for the input to be stored and later rendered. Once stored, the payload executes when an administrator views the submission entry in the admin area, where dangerouslySetInnerHTML is used to render the unsanitized field [1].

Impact

Successful exploitation results in arbitrary JavaScript execution in the context of the WordPress admin interface. An attacker can steal session cookies, modify page content, or perform actions on behalf of an administrator, potentially leading to full site compromise. The confidentiality, integrity, and availability of the WordPress installation are at risk, with the attacker gaining the ability to execute scripts with admin-level privileges.

Mitigation

As of the publication date (2026-05-28), no patched version has been released. Users should disable the "Store Submissions" setting if it is enabled, as this prevents the persistence of unsanitized data and blocks the attack vector. Administrators are advised to monitor the plugin's update channel for a fixed release. The vulnerability has not been listed in CISA's Known Exploited Vulnerabilities (KEV) catalog at the time of writing.