The HT Contact Form – Drag & Drop Form Builder for WordPress plugin is affected by a stored cross‑site scripting flaw because content entered in the Rich Text Editor field is not properly sanitized or escaped before being saved and subsequently displayed. This allows an attacker to embed arbitrary web scripts that are executed automatically whenever a page containing the injected content is accessed by a visitor. The weakness aligns with CWE‑79 and can compromise the integrity of the site’s content and the browsers of all users who view the affected page.

The vulnerability exists in the HT Contact Form plugin for WordPress distributed by HTPlugins, affecting all versions up to and including 2.10.2. WordPress sites that have installed or are running any of those versions and have enabled the rich text editor component in the form builder are at risk. Sites using newer releases, if available, presumably contain the fix, but administrators should confirm the version in use.

With a CVSS score of 7.2 the flaw represents a moderate to high risk. The attack is unauthenticated and stored; the vendor’s description indicates that injected scripts will execute whenever a user loads a page containing the vulnerable content, so all visitors to that page are subject to compromise. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Based on the description, it is inferred that the likely attack vector is a public‑facing form that accepts untrusted input and renders it without proper sanitization, allowing attackers to insert malicious scripts.