CVE-2026-7052

Name of the Vulnerable Software and Affected Versions HT Contact Form – Drag & Drop Form Builder for WordPress versions prior to 2.8.3

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. The issue occurs via the file upload parameter. Exploitation is possible when the 'Store Submissions' setting is enabled, allowing unsanitized values to be saved to the database and later rendered using dangerouslySetInnerHTML in the admin entry viewer, executing the scripts when a user accesses the affected page.

Recommendations Update to a version newer than 2.8.2. Disable the 'Store Submissions' setting as a temporary mitigation measure.