EUVD-2026-88602
GHSA-qxrf-6734-p6v9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach public form with Rich Text Editor field
-
DeliverySubmit payload bypassing input sanitization
-
ExploitPayload stored unescaped in database
-
ExecutionVictim/admin views injected page
-
PersistScript executes in victim browser origin
-
ImpactSession hijack or admin action forgery
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the HT Contact Form plugin (≤2.10.2) installed and active on WordPress, with a form deployed that includes the Rich Text Editor Field accessible to unauthenticated submitters. Per CVSS PR:N/UI:N, no authentication is needed to inject; however, script execution (the actual impact) is deferred and triggers only when a user - typically an administrator reviewing submissions or a visitor to the injected page - accesses the rendered content, so realized impact depends on someone later viewing the stored payload. Limiting factors: the specific Rich Text Editor field must be in use, and value is highest when an authenticated admin views the payload. |
| Impact | This is a genuine but bounded risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) reflects an unauthenticated, low-complexity, network-reachable stored XSS with a scope change (S:C) - the injected script executes in the browser origin of any visitor to the affected page, hence the elevated score despite only Low confidentiality and integrity impact and no availability impact. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no evidence of active exploitation or automated weaponization - the 7.2 is driven by the scope change and unauthenticated reach, not by observed attacker activity. This is a real patch-soon issue for sites running the plugin (stored + unauthenticated is the dangerous combination for XSS), but it is not an emergency: impact is limited to script execution in visitor/admin sessions rather than direct server compromise, and no exploitation signal exists. Note the S:C-driven score can read as more severe than the practical Low/Low impact suggests. |
| Exploit ScenarioDerived | An unauthenticated attacker submits a form containing a malicious payload through the plugin's Rich Text Editor field, which is stored without adequate sanitization. When an administrator or other user later views the page or submission rendering that content, the injected JavaScript executes in their authenticated browser session, enabling session/cookie theft or admin-action forgery. No public proof-of-concept is identified in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Stored cross-site scripting in the HT Contact Form - Drag & Drop Form Builder for WordPress plugin (all versions up to and including 2.10.2) allows unauthenticated attackers to submit a crafted value through a form's Rich Text Editor field that is saved without adequate sanitization and rendered without adequate output escaping. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N scores 7.2, reflecting that injection needs neither authentication nor interaction, but execution is deferred and only occurs when a user - most significantly a logged-in administrator reviewing form submissions, or any visitor to the affected page - loads the poisoned content. Impact is therefore real but bounded: it depends on the Rich Text Editor field being present in a deployed, publicly reachable form and on someone subsequently viewing the stored payload. No public exploit identified at time of analysis, and the plugin author has published a fix changeset referenced by the Wordfence advisory.
RemediationAI
Upstream fix available (WordPress plugin repository changeset 3714946, linked from the Wordfence advisory); the specific released patched version number is not independently confirmed in the available data, so administrators should update the plugin to the newest available release and verify that change 3714946 is included. Until a patched build is deployed, the most effective compensating control is to remove or disable the Rich Text Editor field from any publicly submittable form so no anonymous input reaches the vulnerable storage path - the trade-off is loss of rich formatting in those forms, which can be avoided by substituting the plain-text/textarea field type. If the field must remain, place a filtering layer in front of form submissions (a WAF or WordPress input filter rejecting script, event-handler, and javascript:/data: markup) and review existing stored submissions for injected content, deleting suspect entries; note that naive filters can both false-positive on legitimate rich content and be bypassed by encoding tricks. Because the highest-value target is the administrator reviewing submissions, restrict wp-admin access by IP where practical, enforce least-privilege and strong authentication for accounts that read form entries, and treat suspicious admin page behaviour (unexpected redirects, injected dialogs, new users or option changes) as potential post-exploitation of this XSS. Track the vendor advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/782bcc9b-222e-4fee-a9c4-563e64dda1fd?source=cve and the changeset at https://plugins.trac.wordpress.org/changeset/3714946/ for the final patched version once confirmed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e. cross-site scripting) in the HT Contact Form - Drag & Drop Form Builder for WordPress plugin, identified by CPE cpe:2.3:a:htplugins:ht_contact_form_-_drag_&_drop_form_builder_for_wordpress:*:*:*:*:*:*:*:*. WordPress form-builder plugins routinely accept rich HTML through WYSIWYG/Rich Text Editor fields, which normally demands a strict allow-list sanitizer on save (wp_kses-style filtering) plus contextual escaping on output; here both layers are reported insufficient, so markup supplied by an anonymous form submitter survives into the stored submission and into the rendered page. The CVSS scope change (S:C) is meaningful: the injected script runs in the browsing context of whoever views the submission - commonly an authenticated administrator inside wp-admin - so the consequence can extend beyond the plugin's own security boundary into the wider WordPress administration session, even though confidentiality and integrity impact are each rated Low as the code itself does not guarantee administrative takeover. The vector's PR:N/UI:N confirms the injection step is unauthenticated and requires no victim interaction at submission time; it is important not to read that as immediate, self-triggering code execution, because the payload must still be stored and later viewed before it fires.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Unauthenticated network-reachable stored XSS (PR:N/UI:N); stored payload crosses into the victim's browser origin (S:C) with Low C/I and no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The HT Contact Form - Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Rich Text Editor Field in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Executive ViewAI
A stored cross-site scripting weakness in the HT Contact Form - Drag & Drop Form Builder plugin for WordPress (all versions up to and including 2.10.2) allows unauthenticated attackers to plant malicious content in form submissions that later executes in the browser of anyone loading it - most critically logged-in administrators reviewing those submissions. The practical exposure is bounded because it requires a deployed, publicly reachable form containing a Rich Text Editor field and a subsequent viewing of the poisoned entry, but the administrator-review path makes privilege escalation and site takeover plausible if credentials or sessions are harvested. Leadership should care because the affected surface is customer-facing and administrative at the same time, and any WordPress estate running this plugin is in scope until remediated.
No vendor-released patch identified at time of analysis. Interim mitigations: disable or remove Rich Text Editor fields in publicly reachable forms, deactivate the plugin where it is not business-critical, restrict and monitor the administrator submissions-review screen, enforce a web application firewall or virtual patch blocking script payloads in form input, purge stored submission records containing injected markup, and reset credentials and sessions for administrators who viewed affected entries.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Exploit-DB