HT Contact Form – Drag & Drop Form Builder for WordPress

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   HT Contact Form – Drag & Drop Form Builder for WordPress

Information

Software Type Plugin
Software Slug ht-contactform (view on wordpress.org)
Software Status Active
Software Author htplugins
Software Website theplugindemo.com
Software Downloads 270,742
Software Active Installs 10,000
Software Record Last Updated August 15, 2026

8 Vulnerabilities

Submit a Vulnerability
HT Contact Form <= 2.8.2 - Unauthenticated Stored Cross-Site Scripting via File Upload Field
7.2
CVE-2026-7052
May 27, 2026
Researcher: Azril Fathoni (kiseki)
HT Contact Form – Drag & Drop Form Builder for WordPress <= 2.8.2 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-42728
May 20, 2026
Researcher: daroo
HT Contact Form 7 <= 2.0.0 - Authenticated (Administrator+) Local File Inclusion
6.6
CVE-2025-54015
Jul 16, 2025
Researcher: Ananda Dhakal
HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Upload
9.8
CVE-2025-7340
Jul 14, 2025
Researcher: vgo0
HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Directory Traversal to Arbitrary File Move
9.1
CVE-2025-7360
Jul 14, 2025
Researcher: Phat RiO
HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Deletion
9.1
CVE-2025-7341
Jul 14, 2025
Researcher: vgo0
HT Conctact Form 7 <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-24726
Jan 24, 2025
Researcher: Peter Thaleikis
Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks <= 1.1.5 - Cross-Site Request Forgery to Arbitrary Plugin Activation
4.3
CVE-2023-0484
Feb 28, 2023
Researcher: István Márton
Title Status CVE ID CVSS Researchers Date
HT Contact Form <= 2.8.2 - Unauthenticated Stored Cross-Site Scripting via File Upload Field Patched CVE-2026-7052 7.2 Azril Fathoni (kiseki) May 27, 2026
HT Contact Form – Drag & Drop Form Builder for WordPress <= 2.8.2 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2026-42728 7.2 daroo May 20, 2026
HT Contact Form 7 <= 2.0.0 - Authenticated (Administrator+) Local File Inclusion Patched CVE-2025-54015 6.6 Ananda Dhakal July 16, 2025
HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Upload Patched CVE-2025-7340 9.8 vgo0 July 14, 2025
HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Directory Traversal to Arbitrary File Move Patched CVE-2025-7360 9.1 Phat RiO July 14, 2025
HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Deletion Patched CVE-2025-7341 9.1 vgo0 July 14, 2025
HT Conctact Form 7 <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2025-24726 6.4 Peter Thaleikis January 24, 2025
Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks <= 1.1.5 - Cross-Site Request Forgery to Arbitrary Plugin Activation Patched CVE-2023-0484 4.3 István Márton February 28, 2023

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation