HT Contact Form – Drag & Drop Form Builder for WordPress

HT Contact Form – Drag & Drop Form Builder for WordPress has 11 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 11 are fixed as of October 2026. Their average CVSS score is 7.2, and the most serious one scores 9.8 out of 10. Severity breakdown: 3 critical and 4 high. 2026 was the busiest year with 5 disclosures.

The most common weakness is Cross-Site Scripting, behind 5 of the records (45%). Other recurring categories include Cross-Site Request Forgery (CSRF), Exposure Of Sensitive Information To An Unauthorized Actor.

Every one of the 11 issues recorded for HT Contact Form – Drag & Drop Form Builder for WordPress has a vendor fix available, so running the current release closes all known holes.

10 independent researchers contributed these findings, most of them (2) reported by vgo0. HT Contact Form – Drag & Drop Form Builder for WordPress is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

01234567891003.03.2019Today28.02.20234.3Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks <= 1.1.5 - Cross-Site Request Forgery to Arbitrary Plugin Activation CVSS 4.3 · 28.02.202324.01.20256.4HT Conctact Form 7 <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 24.01.202514.07.20259.1HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Directory Traversal to Arbitrary File Move CVSS 9.1 · 14.07.20259.1HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Deletion CVSS 9.1 · 14.07.20259.8HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Upload CVSS 9.8 · 14.07.202516.07.20256.6HT Contact Form 7 <= 2.0.0 - Authenticated (Administrator+) Local File Inclusion CVSS 6.6 · 16.07.202520.05.20267.2HT Contact Form – Drag & Drop Form Builder for WordPress <= 2.8.2 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 20.05.202627.05.20267.2HT Contact Form <= 2.8.2 - Unauthenticated Stored Cross-Site Scripting via File Upload Field CVSS 7.2 · 27.05.202606.08.20265.3HT Contact Form <= 2.9.2 - Unauthenticated Information Exposure CVSS 5.3 · 06.08.202624.09.20267.2HT Contact Form <= 2.10.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'form_data' Rich Text Field via Draft Save/Resume CVSS 7.2 · 24.09.202628.09.20267.2HT Contact Form – Drag & Drop Form Builder for WordPress <= 2.10.2 Unauthenticated Stored Cross-Site Scripting via Rich Text Editor Field CVSS 7.2 · 28.09.2026

Strategic Overview

Avg CVSSHigh
7.2/ 10
Patch Coverage100%
Open

0

Fixed

11

Get automatic notifications for all HT Contact Form – Drag & Drop Form Builder for WordPress vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2025-7340

HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Upload

Read the full analysis

Vulnerability Records

11 records
2026-09-28 13:26CVE-2026-96326
7.2
High
Muhammad Yudha - DJYes
2026-09-24 18:23CVE-2026-93303
7.2
High
kuzomoYes
2026-08-06 00:00CVE-2026-14206
5.3
Medium
Mustafa AhmedYes
2026-05-27 18:06CVE-2026-7052
7.2
High
Azril Fathoni (kiseki)Yes
2026-05-20 00:00CVE-2026-42728
7.2
High
darooYes
2025-07-16 00:00CVE-2025-54015
6.6
Medium
Ananda DhakalYes
2025-07-14 15:59CVE-2025-7340
9.8
Critical
vgo0Yes
2025-07-14 15:58CVE-2025-7360
9.1
Critical
Phat RiOYes
2025-07-14 15:58CVE-2025-7341
9.1
Critical
vgo0Yes
2025-01-24 00:00CVE-2025-24726
6.4
Medium
Peter ThaleikisYes
Showing 1–10 of 11 reports
HT Contact Form – Drag & Drop Form Builder for WordPress banner
Latestv2.10.3

HT Contact Form – Drag & Drop Form Builder for WordPress

HT Plugins

Author

HT Plugins

4.2(5)
84/100
Last Updated
2026-09-27 (1mo ago)
Active Installs
10,000+
Downloads
299,947
Requires WP
5.0+
Requires PHP
0+
Tested up to
WP 7.1.3
Created
2019-03-03 (8y ago)

Stop struggling with complicated form plugins. HT Contact Form is the WordPress form builder that gets out of your way and lets you create beautiful, functional forms in minutes – not hours. Whether you need a simple contact form, a detailed application, or a complex survey with conditional logic, HT Contact Form has you covered. No coding required. No expensive add-ons. Just drag, drop, and publish. Learn More | Documentation | Support Key Features 🎨 Drag & Drop Builder – Design forms visually with our intuitive builder. No coding needed. 📝 38+ Form Fields – Everything from basic text inputs to signatures, file uploads, and repeater fields. 🔗 21+ Integrations – Connect to Mailchimp, HubSpot, Zapier, Slack, and more – all included free. 💾 Save & Resume – Let users save their progress and complete forms later via unique link. 🔀 Conditional Logic – Show or hide fields based on user selections. 🛡️ Spam Protection – Built-in honeypot, reCAPTCHA v2/v3, and hCaptcha support. 📊 Entry Management – Store, search, filter, and export all submissions from your dashboard. 📧 Email Notifications – Instant alerts with 5 pre-designed email templates. 🏷️ Smart Tags – Dynamic field values that auto-populate from user data, URLs, or other fields. 📱 Fully Responsive – Forms look perfect on desktop, tablet, and mobile. 🎯 Form Styling – Customize colors, fonts, borders, and spacing to match your brand. 📤 Export Options – Download entries as CSV, Excel, ODS, or JSON. What’s New 🔗 9 New Integrations – Connect forms to GetResponse, Drip, Moosend, iContact, MailPoet, Notion, Trello, HubSpot, and Zoho CRM. 📧 Email Marketing – GetResponse, Drip, Moosend, iContact, and MailPoet integrations for subscriber management. 💼 CRM Integrations – HubSpot and Zoho CRM for contact and lead management. 📂 Productivity Tools – Notion databases and Trello boards integration for workflow automation. Build Any Form You Need 📬 Contact Forms – Simple inquiry forms with name, email, and message 🎯 Lead Generation – Capture leads with custom fields and send to your CRM 📋 Surveys & Feedback – Multi-question forms with ratings, NPS, and conditional logic ✅ Signup Forms – Collect user details for newsletters, events, or services 📄 Application Forms – Long forms with save & resume functionality 🎫 Support Requests – Ticket creation with file attachments and priority selection 38+ Form Fields ✏️ Basic Input Text, Textarea, Email, Number, Phone, Password, Website, Name (with formats) ☑️ Selection Dropdown, Radio Buttons, Checkboxes, Multiple Choice, Country List ⚙️ Advanced Repeater (dynamic rows), Chained Select, Post Selection, Rich Text Editor 📅 Date & Time Date/Time Picker (with calendar and time selection) 📎 Uploads File Upload, Image Upload, Signature Capture 🧩 Layout Section Break, Custom HTML, Shortcode Embed 🔐 Security reCAPTCHA (v2 & v3), hCaptcha, GDPR Consent, Terms & Conditions ⭐ Special Save & Resume, Star Rating, NPS Score, Color Picker, Range Slider, Mask Input, Hidden Field, Action Hook 21+ Integrations 📧 Email Marketing Mailchimp, ActiveCampaign, MailerLite, GetResponse, Drip, Moosend, iContact, MailPoet, Constant Contact, Brevo 💼 CRM HubSpot, Zoho CRM, Insightly, OnepageCRM 📂 Productivity Notion, Trello, Slack, Discord ⚡ Automation Zapier (connect to 5000+ apps), Custom Webhooks 🎫 Support Support Genix (helpdesk tickets) Why Choose HT Contact Form? 💰 Free & Powerful – Get features that competitors charge hundreds for. No form limits, no entry limits, no hidden costs. ⚡ Modern Interface – Built with React for a fast, smooth admin experience. No page reloads, instant previews. 🔗 All Integrations Included – 21+ integrations at no extra cost. Connect your forms to the tools you already use. 👨‍💻 Developer Friendly – Action hooks, custom HTML fields, and webhook support for unlimited extensibility. 🚀 Active Development – Regular updates with new fields, integrations, and features based on user feedback. Other Projects ShopLentor (Woolentor) – WooCommerce page builder with 125+ widgets, 36 modules including Shopify-style checkout, Quick View, Wishlist, and Compare features. Support Genix – AI-powered helpdesk with ticketing system, knowledge base, and 24/7 chatbot support for customer service. HT Mega For Elementor – Elementor addon with 135+ widgets, AI Content Writer, Theme Builder, Mega Menu Builder, and 790+ ready blocks. Hashbar WP Notification Bar – Create unlimited notification bars for announcements, promotions, and alerts. HT Easy GA4 – Track your website visitors and view Google Analytics dashboard reports from your website. WP Plugin Manager – Disable certain plugins on specific pages or posts for better performance. Activate or deactivate plugins on a per-page basis. Extensions For CF7 – Contact Form 7 Database, Conditional Fields, and Mailchimp integration for lead generation. Whols – WooCommerce wholesale pricing plugin. Set wholesale prices, custom registration fields, and minimum requirements. Works like Wholesale Suite, B2Bking. JustTables – WooCommerce product table plugin with 28 pre-built columns, custom fields support, and drag-and-drop ordering. Swatchly – WooCommerce product variation swatches with color, label, and image swatch types. HT Slider For Elementor – Powerful slider addon for Elementor with custom styling options and navigation controls. 🎬 Video created by the community Need Help? Have a feature request or need assistance? Contact Us

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C