The HT Contact Form – Drag & Drop Form Builder for WordPress plugin stores user‑generated rich text in a draft field without proper sanitization or escaping. A malicious author can embed script tags or other executable payloads into the form_data field when creating or updating a draft. When a victim clicks the draft resume link, the plugin renders this stored data into a page that the browser interprets without additional escaping, allowing the attacker’s script to execute in the victim’s browser context. This stored DOM‑based XSS can lead to cookie theft, session hijacking, phishing or other malicious activity.

The flaw is present in all releases of the HT Contact Form – Drag & Drop Form Builder for WordPress plugin up through version 2.10.1, as indicated by the vendor’s own product listing. Users of any of these releases are susceptible because the vulnerable code path is executed on all draft resume requests.

The CVSS score of 7.2 reflects a moderate‑to‑high severity that requires only an unauthenticated user to click a crafted link. Exploitation demands that an attacker first create a malicious draft containing the script payload and then trick a target user into visiting the corresponding resume URL. The draft_key and access_token are returned in the save response and are used directly to build that link, exposing the attack vector. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, but the inherent client‑side execution and requirement for user interaction produce a tangible risk. Site operators should consider this a serious threat.