PatchSiren cyber security CVE debrief
CVE-2026-7052 htplugins CVE debrief
HT Contact Form – Drag & Drop Form Builder for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'file_upload' parameter in versions up to and including 2.8.2. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts. Exploitation requires the 'Store Submissions' setting to be enabled, which persists unsanitized field values to the database and renders them via dangerouslySetInnerHTML in the admin entry viewer. The vulnerability was published on 2026-05-28 and carries a HIGH severity CVSS score of 7.2.
- Vendor
- htplugins
- Product
- HT Contact Form – Drag & Drop Form Builder for WordPress
- CVSS
- HIGH 7.2
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-28
- Original CVE updated
- 2026-05-28
- Advisory published
- 2026-05-28
- Advisory updated
- 2026-05-28
Who should care
WordPress site administrators using HT Contact Form plugin, security teams monitoring WordPress plugin vulnerabilities, and developers maintaining custom form implementations with similar submission storage patterns
Technical summary
The vulnerability exists in the file_upload parameter handling where user-supplied input is stored without adequate sanitization. When 'Store Submissions' is enabled, form data including the malicious file_upload value is persisted to the database. The admin entry viewer component renders this data using dangerouslySetInnerHTML, executing injected scripts in the administrator's browser context. Attack vector is network-based with low attack complexity, no privileges required, and no user interaction needed for the stored payload to execute when an admin views the entry.
Defensive priority
HIGH
Recommended defensive actions
- Upgrade HT Contact Form plugin to version 2.8.3 or later
- Disable 'Store Submissions' setting if not required as an immediate mitigation
- Review admin entry viewer for any suspicious script injections
- Implement Content Security Policy headers to mitigate XSS impact
- Audit form submission data for unexpected script content
Evidence notes
Vulnerability confirmed via WordPress plugin repository source code analysis. Multiple source references identify specific file locations in both tagged version 2.8.2 and trunk where insufficient sanitization occurs. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N supports network attack vector with no privileges required. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the primary weakness classification.
Sources and references
Verified primary and authoritative sources
-
CVE-2026-7052 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2026-7052
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2026-7052 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2026-7052
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/ht-contactform/tags/2.8.2/admin/Includes/Api/Endpoints/Submission.php
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/ht-contactform/tags/2.8.2/admin/Includes/Api/Endpoints/Submission.php
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/ht-contactform/tags/2.8.2/admin/Includes/Api/Endpoints/Submission.php
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/ht-contactform/tags/2.8.2/admin/Includes/Models/Entries.php
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/ht-contactform/tags/2.8.2/admin/dist/bundle.js
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/ht-contactform/trunk/admin/Includes/Api/Endpoints/Submission.php
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/ht-contactform/trunk/admin/Includes/Api/Endpoints/Submission.php
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.