What is the CVSS score of CVE-2026-7052?

CVE-2026-7052 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of HT Contact Form are affected by CVE-2026-7052?

The HT Contact Form - Drag & Drop Form Builder plugin for WordPress (versions up to 2.8.2) contains a stored cross-site scripting vulnerability that enables unauthenticated attackers to inject…

How to fix or mitigate CVE-2026-7052?

Within 24 hours: Inventory all WordPress sites running HT Contact Form ≤2.8.2; disable the 'Store Submissions' setting or deactivate the plugin entirely if not mission-critical; monitor administrator account access logs. Within 7 days: Implement WAF rules to block form submissions containing suspicious JavaScript; force password reset for all WordPress administrator accounts; audit admin panel audit logs for unauthorized activity during exposure window. Within 30 days: Migrate to alternative contact form solutions (WPForms, Gravity Forms, or Formidable Forms); conduct comprehensive security assessment of affected WordPress installations for evidence of compromise.

HT Contact Form CVE-2026-7052

EUVD-2026-32740 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-28 Wordfence

GHSA-jvfv-xgr4-q7p3

XSS WordPress

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 07:51 vuln.today

CVE Published

May 28, 2026 - 06:45 nvd

HIGH 7.2

DescriptionCVE.org

The HT Contact Form - Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'file_upload' parameter in all versions up to, and including, 2.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the 'Store Submissions' setting to be enabled, as this controls whether unsanitized field values are persisted to the database and subsequently rendered via dangerouslySetInnerHTML in the admin entry viewer.

AnalysisAI

Stored cross-site scripting in the HT Contact Form - Drag & Drop Form Builder for WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote attackers to inject persistent JavaScript via the 'file_upload' parameter, which gets rendered via dangerouslySetInnerHTML in the admin entry viewer. The injected payload executes in the browser context of any administrator who opens the affected submission, enabling session theft, privilege abuse, or arbitrary admin actions. No public exploit identified at time of analysis, and the issue requires the plugin's 'Store Submissions' setting to be enabled for the unsanitized values to persist.

Technical ContextAI

The vulnerability resides in HT Contact Form's submission handling code (admin/Includes/Api/Endpoints/Submission.php and admin/Includes/Models/Entries.php), where user-supplied values from the 'file_upload' form field are accepted via a public REST API endpoint without proper sanitization, then later rendered in the React-based admin interface (admin/dist/bundle.js) using dangerouslySetInnerHTML. This pattern bypasses React's default XSS protections by treating the persisted string as raw HTML. The root cause class is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the stored variant where untrusted persistent storage is later concatenated into a privileged DOM context. The CPE identifies the affected component as cpe:2.3:a:htplugins:ht_contact_form_-_drag_&_drop_form_builder_for_wordpress:*.

RemediationAI

Upstream fix available (changeset 3521197 in the plugin's trunk on plugins.trac.wordpress.org); released patched version not independently confirmed in the provided data, so administrators should upgrade to the latest version published on the WordPress plugin directory beyond 2.8.2 and consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/edb0ee0c-1eab-4988-9eb6-cc0c253fee15?source=cve for the exact fixed release. As a workaround until patching, disable the 'Store Submissions' setting in the plugin configuration to prevent unsanitized field values from being persisted and later rendered - note the trade-off is loss of in-database submission history, so ensure forms are configured to email submissions instead. Alternatively, deactivate the plugin or restrict access to the wp-json REST endpoint that accepts submissions via a WAF rule that strips HTML/script content from the 'file_upload' parameter, accepting the side effect of potential false positives on legitimate filenames containing special characters.