CVE-2026-93303Published
HT Contact Form <= 2.10.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'form_data' Rich Text Field via Draft Save/Resume
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-93303 · Microsoft / collected KEV context
cve-program · CVE-2026-93303
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d5c3702c-65d3-4b89-a78f-6df267b02a1e?source=cve
- https://plugins.trac.wordpress.org/browser/ht-contactform/tags/2.10.1/assets/js/form.js#L2053
- https://plugins.trac.wordpress.org/browser/ht-contactform/tags/2.10.1/admin/Includes/Api/Endpoints/Draft.php#L199
- https://plugins.trac.wordpress.org/browser/ht-contactform/tags/2.10.1/admin/Includes/Api/Endpoints/Draft.php#L74
- https://plugins.trac.wordpress.org/browser/ht-contactform/tags/2.10.1/admin/Includes/Models/Drafts.php#L239
- https://plugins.trac.wordpress.org/browser/ht-contactform/tags/2.10.1/admin/Includes/Api/Endpoints/Draft.php#L336
- https://plugins.trac.wordpress.org/browser/ht-contactform/tags/2.10.1/include/UI/ShortCode.php#L726
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3707224%40ht-contactform&new=3707224%40ht-contactform
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.