htplugins vulnerabilities

CVEs per yearBy the year they were published

1. 20242
2. 20258
3. 20265

Newest CVEs

• CVE-2026-94589

  Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.4.5 - Unauthenticated Arbitrary File Upload via Signature Field File Upload

  htplugins · Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection)

  Critical9.8
• CVE-2026-96326

  HT Contact Form – Drag & Drop Form Builder for WordPress <= 2.10.2 Unauthenticated Stored Cross-Site Scripting via Rich Text Editor Field

  htplugins · HT Contact Form – Drag & Drop Form Builder for WordPress

  High7.2
• CVE-2026-93303

  HT Contact Form <= 2.10.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'form_data' Rich Text Field via Draft Save/Resume

  htplugins · HT Contact Form – Drag & Drop Form Builder for WordPress

  High7.2
• CVE-2026-7052

  HT Contact Form <= 2.8.2 - Unauthenticated Stored Cross-Site Scripting via File Upload Field

  htplugins · HT Contact Form – Drag & Drop Form Builder for WordPress

  High7.2
• CVE-2026-1888

  Docus <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

  htplugins · Docus – YouTube Video Playlist

  Medium6.4
• CVE-2025-13838

  WishSuite <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button_text' Shortcode Attribute

  htplugins · WishSuite – Wishlist for WooCommerce

  Medium6.4
• CVE-2025-14278

  HT Slider for Elementor <= 1.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

  htplugins · HT Slider For Elementor

  Medium6.4
• CVE-2025-12112

  Insert Headers and Footers Code – HT Script <= 1.1.6 - Authenticated (Author+) Stored Cross-Site Scripting

  htplugins · Insert Headers and Footers Code – HT Script

  Medium6.4
• CVE-2025-7645

  Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.2.8 - Unauthenticated Arbitrary File Deletion Triggered via Admin Form Submission Deletion

  htplugins · Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection)

  High8.1
• CVE-2025-7340

  HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Upload

  htplugins · HT Contact Form – Drag & Drop Form Builder for WordPress

  Critical9.8