The HT Contact Form plugin includes a stored XSS flaw in the file_upload field, where uploaded data is not properly sanitized or escaped before being saved to the database. When the "Store Submissions" option is enabled, the unsanitized input is later rendered by the admin entry viewer using dangerouslySetInnerHTML, causing any stored script to run in a visitor’s browser. This allows an unauthenticated attacker to deliver arbitrary JavaScript that executes with the privileges of the range of users who can view the entry page, enabling data theft, session hijacking, or further site compromise.

This vulnerability affects WordPress sites running the HT Contact Form – Drag & Drop Form Builder for WordPress plugin (htplugins) with any version up to and including 2.8.2. The flaw is present in all releases prior to the patch that removed the vulnerable code path.

The technical score for this issue is CVSS 3.1 7.2, indicating a high severity. No EPSS data is provided, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the "Store Submissions" setting to be active, but the attack vector is any attacker who can submit a form with a crafted file_upload value. Because the malicious code is stored and later rendered, the impact is carried out from the victim’s browser each time an entry is viewed, making it a serious threat especially for administrators or other users with entry‑viewer access.