htplugins
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| HT Contact Form – Drag & Drop Form Builder for WordPress | 6 | – | Sep 29, 2026 |
| Insert Headers and Footers Code – HT Script | 2 | – | Nov 8, 2025 |
| Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) | 2 | – | Oct 10, 2026 |
| WishSuite – Wishlist for WooCommerce | 1 | – | Dec 21, 2025 |
| Docus – YouTube Video Playlist | 1 | – | Feb 6, 2026 |
| WP Team – WordPress Team Member Plugin | 1 | – | Oct 30, 2024 |
| HT Easy GA4 – Google Analytics WordPress Plugin | 1 | – | Mar 13, 2024 |
| HT Slider For Elementor | 1 | – | Dec 13, 2025 |
Exploited and recent CVEs
- CVE-2026-94589 Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.4.5 - Unauthenticated Arbitrary File Upload via Signature Field File Upload 0.7%
- CVE-2026-96326 HT Contact Form – Drag & Drop Form Builder for WordPress <= 2.10.2 Unauthenticated Stored Cross-Site Scripting via Rich Text Editor Field 0.2%
- CVE-2026-93303 HT Contact Form <= 2.10.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'form_data' Rich Text Field via Draft Save/Resume 0.2%
- CVE-2026-7052 HT Contact Form <= 2.8.2 - Unauthenticated Stored Cross-Site Scripting via File Upload Field 0.3%
- CVE-2026-1888 Docus <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes 0.3%
- CVE-2025-13838 WishSuite <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button_text' Shortcode Attribute 0.2%
- CVE-2025-14278 HT Slider for Elementor <= 1.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.2%
- CVE-2025-12112 Insert Headers and Footers Code – HT Script <= 1.1.6 - Authenticated (Author+) Stored Cross-Site Scripting 0.2%
- CVE-2025-7645 Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.2.8 - Unauthenticated Arbitrary File Deletion Triggered via Admin Form Submission Deletion 0.9%
- CVE-2025-7340 HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Upload 1.8%
- CVE-2025-7360 HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Directory Traversal to Arbitrary File Move 1.5%
- CVE-2025-7341 HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Deletion 1.2%
- CVE-2025-2779 Insert Headers and Footers Code – HT Script <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update 0.3%
- CVE-2024-10223 HT Team Member <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via htteamember Shortcode 0.3%
- CVE-2024-1176 HT Easy GA4 – Google Analytics WordPress Plugin <= 1.1.5 - Missing Authorization to Unauthenticated GA4 Email Update 0.6%