Plugin icon

HT Contact Form – Drag & Drop Form Builder for WordPress

ht-contactform

Vulnerabilities:

9

Last Updated:

August 2, 2026

Active Installs:

10000

Published
Title
Fixed in
CVSS
Published
2026-08-06
Title
HT Contact Form < 2.9.3 - Unauthenticated Saved Form Draft Data Disclosure
Fixed in
Fixed in 2.9.3
CVSS
3.7 (low)
Published
2026-05-27
Title
HT Contact Form < 2.8.3 - Unauthenticated Stored Cross-Site Scripting via File Upload Field
Fixed in
Fixed in 2.8.3
CVSS
7.2 (high)
Published
2026-05-20
Title
HT Contact Form – Drag & Drop Form Builder for WordPress < 2.8.3 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 2.8.3
CVSS
7.2 (high)
Published
2025-07-16
Title
HT Contact Form 7 < 2.1.0 - Authenticated (Administrator+) Local File Inclusion
Fixed in
Fixed in 2.1.0
CVSS
6.6 (medium)
Published
2025-07-14
Title
HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. < 2.2.2 - Unauthenticated Arbitrary File Upload
Fixed in
Fixed in 2.2.2
CVSS
9.8 (critical)
Published
2025-07-14
Title
HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. < 2.2.2 - Directory Traversal to Arbitrary File Move
Fixed in
Fixed in 2.2.2
CVSS
9.1 (critical)
Published
2025-07-14
Title
HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. < 2.2.2 - Unauthenticated Arbitrary File Deletion
Fixed in
Fixed in 2.2.2
CVSS
9.1 (critical)
Published
2025-01-24
Title
HT Conctact Form 7 < 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.2.2
CVSS
6.4 (medium)
Published
2023-02-28
Title
Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks < 1.1.6 - Arbitrary Plugin Activation via CSRF
Fixed in
Fixed in 1.1.6
CVSS
4.3 (medium)