CVE-2026-96326— HT Contact Form – Drag & Drop Form Builder for WordPress <= 2.10.2 Unauthenticated Stored Cross-Site Scripting via Rich Text Editor Field
Quick assessment
Affected
htplugins HT Contact Form – Drag & Drop Form Builder for WordPress
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 插件“HT Contact Form – Drag & Drop Form Builder”在所有截至 2.10.2 版本（包含 2.10.2）中均存在存储型跨站脚本（Stored Cross-Site Scripting, XSS）漏洞，该漏洞源于富文本编辑器字段在输入 sanitization（清理）和输出转义方面存在不足。此漏洞允许未经身份验证的攻击者在网页中注入任意的 Web 脚本，当用户访问被注入的页面时，这些脚本将自动执行。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-96326
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
HT Contact Form – Drag & Drop Form Builder for WordPress <= 2.10.2 Unauthenticated Stored Cross-Site Scripting via Rich Text Editor Field
Source: CVE Program / CVE List V5
Vulnerability Description
The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Rich Text Editor Field in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| htplugins | HT Contact Form – Drag & Drop Form Builder for WordPress | 0 ~ 2.10.2 | - |
|
II. Public POCs for CVE-2026-96326
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-96326
请登录查看更多情报信息。
Other References for CVE-2026-96326 (2)
IV. Related Vulnerabilities
Same product: HT Contact Form – Drag & Drop Form Builder for WordPress
-
CVE-2026-93303
HT Contact Form <= 2.10.1 - Unauthenticated Stored DOM-Based -
CVE-2026-7052
HT Contact Form <= 2.8.2 - Unauthenticated Stored Cross-Site -
CVE-2025-7360
HT Contact Form Widget For Elementor Page Builder & Gutenber -
CVE-2025-7340
HT Contact Form Widget For Elementor Page Builder & Gutenber -
CVE-2025-7341
HT Contact Form Widget For Elementor Page Builder & Gutenber
Same vendor: htplugins
-
CVE-2026-93303
HT Contact Form <= 2.10.1 - Unauthenticated Stored DOM-Based -
CVE-2026-7052
HT Contact Form <= 2.8.2 - Unauthenticated Stored Cross-Site -
CVE-2026-1888
Docus <= 1.0.6 - Authenticated (Contributor+) Stored Cross-S -
CVE-2025-13838
WishSuite <= 1.5.1 - Authenticated (Contributor+) Stored Cro -
CVE-2025-14278
HT Slider for Elementor <= 1.7.4 - Authenticated (Contributo
Same weakness: CWE-79
-
CVE-2026-102374
GestSup before 3.2.62 Stored XSS via Double-Decoded Email Su -
CVE-2026-102372
GestSup before 3.2.62 Stored XSS via Email Body in LOGIN IMA -
CVE-2026-102333
httpdbg before 2.2.1 Stored Cross-Site Scripting via javascr -
CVE-2026-101141
Eleveo Call Recording Software Play Audio audio.jsp cross si -
CVE-2026-101111
Joomla Extension - ordasoft.com - Reflected Cross-Site Scrip
V. Comments for CVE-2026-96326
No comments yet