Stored DOM-Based XSS in HT Contact Form WordPress Plugin

The HT Contact Form - Drag & Drop Form Builder for WordPress plugin is vulnerable to a stored DOM-based cross-site scripting (XSS) vulnerability (CVE-2026-93303) affecting all versions up to and including 2.10.1. The flaw resides in the 'form_data' Rich Text Field, specifically within the draft save and resume functionality. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject malicious scripts into saved form drafts. To exploit this, an attacker must trick an authenticated user into interacting with a crafted URL containing a valid 'draft_key' and 'access_token', which the attacker can retrieve from the plugin's response. Successful execution occurs in the context of the victim's browser session, potentially allowing unauthorized actions or session hijacking.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of an administrator or user accessing the injected form page. This could result in unauthorized administrative actions, sensitive data exfiltration, or the creation of new administrative accounts within the WordPress instance.

Recommendation

1. Patch immediately by upgrading the HT Contact Form - Drag & Drop Form Builder for WordPress plugin to a version greater than 2.10.1.
2. Audit WordPress site logs for anomalous POST requests to the plugin's draft save endpoints if unauthorized modifications are suspected.
3. Implement a strict Content Security Policy (CSP) to mitigate the impact of potential XSS attacks by restricting the sources of executable scripts.