Advisories · Technology
htplugins HT Contact Form – Drag & Drop Form Builder for WordPress.
Every CVE that names htplugins HT Contact Form – Drag & Drop Form Builder for WordPress among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.2 High
HT Contact Form – Drag & Drop Form Builder for WordPress <= 2.10.2 Unauthenticated Stored Cross-Site Scripting via Rich Text Editor Field
- htplugins HT Contact Form – Drag & Drop Form Builder for WordPress
- Cross-site scripting (XSS)
- CVSS 7.2 High
HT Contact Form <= 2.10.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'form_data' Rich Text Field via Draft Save/Resume
- htplugins HT Contact Form – Drag & Drop Form Builder for WordPress
- Cross-site scripting (XSS)
- CVSS 7.2 High
HT Contact Form <= 2.8.2 - Unauthenticated Stored Cross-Site Scripting via File Upload Field
- htplugins HT Contact Form – Drag & Drop Form Builder for WordPress
- Cross-site scripting (XSS)
- CVSS 9.8 CriticalCritical · CVSS 9+
HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Upload
- htplugins HT Contact Form – Drag & Drop Form Builder for WordPress
- Unrestricted file upload
- CVSS 9.1 CriticalCritical · CVSS 9+
HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Directory Traversal to Arbitrary File Move
- htplugins HT Contact Form – Drag & Drop Form Builder for WordPress
- Path traversal
- CVSS 9.1 CriticalCritical · CVSS 9+
HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Deletion
- htplugins HT Contact Form – Drag & Drop Form Builder for WordPress
- Privilege escalation