CVE-2026-7052: Stored XSS in HT Contact Form WordPress Plugin (v2.8.2 & Earlier)

Technical summary

CVE-2026-7052 is a stored XSS vulnerability (CWE-79) in the HT Contact Form plugin stemming from insufficient input sanitization and output escaping of the 'file_upload' parameter. When form submissions are stored (controlled by the 'Store Submissions' setting), unsanitized field data is rendered in the WordPress admin entry viewer using dangerouslySetInnerHTML, allowing arbitrary JavaScript execution. The vulnerability is network-accessible, requires no authentication, and affects all versions up to and including 2.8.2. CVSS 3.1 score: 7.2 (HIGH).

Business impact

Administrators of sites running vulnerable versions risk account compromise, credential theft, and lateral movement into WordPress infrastructure. Attackers can inject malicious scripts that steal session tokens, trigger plugin installations, modify site content, or redirect visitors to phishing pages. For multi-site or enterprise WordPress deployments, a single compromised form can expose multiple administrative accounts. The attack surface is broad because contact forms are ubiquitous, and many sites leave 'Store Submissions' enabled by default for compliance and customer service workflows.

Affected systems

WordPress sites using HT Contact Form – Drag & Drop Form Builder plugin version 2.8.2 and earlier are affected. Vulnerability requires the 'Store Submissions' feature to be enabled. Sites that have disabled this setting or use alternative form builders are not impacted. The plugin is widely distributed; administrators should verify installation status via the WordPress admin dashboard or plugin audit tools.

Exploitability

Exploitability is high. No authentication is required; an attacker can submit a malicious form from the public internet. Once injected, the payload persists in the database and executes automatically whenever an administrator views submissions. No special user interaction is needed beyond normal admin activity. However, the attack requires that 'Store Submissions' be enabled—if disabled, submissions are not persisted and the vulnerability cannot be exploited in that configuration.

Remediation

Upgrade HT Contact Form to a patched version released after 2.8.2 (verify against the official plugin repository or vendor advisory for the specific version number). If an immediate upgrade is not possible, disable the 'Store Submissions' setting in plugin configuration to prevent payload persistence. Additionally, audit existing form submissions in the database for suspicious content, and consider temporarily deactivating the plugin if it is not actively in use. Clear browser caches and invalidate admin sessions to remove any cached malicious scripts.

Patch guidance

Contact the plugin vendor or check the WordPress.org plugin repository for the latest security update. Updates typically address the vulnerability by implementing proper input sanitization and output escaping for all user-supplied form fields. Verify the update version number in the plugin advisory before deployment. Test patched versions in a staging environment first to ensure compatibility with custom forms and integrations. After upgrading, re-enable 'Store Submissions' if it was disabled as a temporary mitigation.

Detection guidance

Monitor form submission logs and database entries for unusual JavaScript patterns, event handlers (e.g., onerror, onclick), or HTML tags within file_upload fields. Review admin audit logs for unexpected script execution or admin session anomalies. Use WordPress security plugins to detect stored XSS signatures in post meta and form submission data. Search for payloads containing common XSS vectors: <script>, javascript:, onerror=, and event handler attributes. Implement Web Application Firewall (WAF) rules to detect and block form submissions containing unescaped HTML or script tags targeting this parameter.

Why prioritize this

This is a HIGH-priority vulnerability due to the combination of high CVSS score (7.2), broad attack surface (public-facing forms requiring no authentication), and direct impact on administrative accounts. The stored nature of the XSS increases persistence and likelihood of successful exploitation. Given the ubiquity of contact forms in WordPress ecosystems, widespread plugin adoption, and ease of exploitation, this should be treated as critical for any organization running affected versions with 'Store Submissions' enabled.

Risk score, explained

CVSS 3.1 score of 7.2 reflects: (1) network-accessible attack vector, (2) low attack complexity (no special conditions required), (3) no privileges or user interaction needed for payload injection, (4) scope changed (impact extends beyond vulnerable component to admin interface), and (5) confidentiality and integrity impact (unauthorized script execution, data theft, account compromise). The score would be higher if availability were impacted or if the attack required authentication.

Frequently asked questions