Htplugins vulnerabilities
We track 8 vulnerabilities in Htplugins products across 2 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on October 10, 2026.
Latest Htplugins vulnerabilities
- 9.8 Critical severity
Extensions For CF7 (Contact form 7 Database…: Unrestricted Upload of File with Dangerous Type
The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.4.5 via the extcf7_submit function. This is due to missing file extension,
- 7.2 High severity
HT Contact Form – Drag & Drop Form Builder for…: Improper Neutralization of Input During Web Page Generation
The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Rich Text Editor Field in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escapin
- 7.2 High severity
HT Contact Form – Drag & Drop Form Builder for…: Improper Neutralization of Input During Web Page Generation
The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'form_data' Rich Text Field via Draft Save/Resume in all versions up to, and including, 2.10.1 due to insufficient inpu
- 7.2 High severity
HT Contact Form – Drag & Drop Form Builder for…: Improper Neutralization of Input During Web Page Generation
The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'file_upload' parameter in all versions up to, and including, 2.8.2 due to insufficient input sanitization and output escapin
- 8.1 High severity
Extensions For CF7 (Contact form 7 Database…: Improper Limitation of a Pathname to a Restricted Directory
The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete-file' field in all versions up to, and including, 3.2.8.
- 9.8 Critical severity
HT Contact Form – Drag & Drop Form Builder for…: Improper Limitation of a Pathname to a Restricted Directory
The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation in the handle_files_upload() function in all versions up to, and includ
- 9.8 Critical severity
HT Contact Form – Drag & Drop Form Builder for…: Improper Privilege Management
The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the temp_file_delete() function in all versions up to, and includi
- 9.8 Critical severity
HT Contact Form – Drag & Drop Form Builder for…: Unrestricted Upload of File with Dangerous Type
The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the temp_file_upload() function in all versions up to, and including, 2.