Kuzomo

**Name of the Vulnerable Software and Affected Versions** HT Contact Form – Drag & Drop Form Builder for WordPress versions prior to 2.10.2 **Description** Insufficient input sanitization and output escaping in the `form data` Rich Text Field allow unauthenticated attackers to perform Stored DOM-Based Cross-Site Scripting. This occurs during the Draft Save/Resume process, enabling the injection of arbitrary web scripts into pages. These scripts execute when a user accesses the affected page. To exploit this, an attacker must trick a user into clicking a specially crafted draft resume URL created using the `draft key` and `access token` variables returned in the save response. **Recommendations** Update to a version newer than 2.10.1.