{"items":[{"id":"CVE-2026-94589","published":"2026-10-10T03:26:46.082Z","updated":"2026-10-11T16:55:19.810Z","title":"Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.4.5 - Unauthenticated Arbitrary File Upload via Signature Field File Upload","severity":"CRITICAL","score":9.8,"vendor":"htplugins","product":"Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection)","kev":false,"epss":0.00656,"kevAdded":null},{"id":"CVE-2026-96326","published":"2026-09-29T01:27:51.301Z","updated":"2026-09-30T15:28:20.488Z","title":"HT Contact Form – Drag & Drop Form Builder for WordPress <= 2.10.2 Unauthenticated Stored Cross-Site Scripting via Rich Text Editor Field","severity":"HIGH","score":7.2,"vendor":"htplugins","product":"HT Contact Form – Drag & Drop Form Builder for WordPress","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-93303","published":"2026-09-25T06:39:56.300Z","updated":"2026-09-25T13:00:16.456Z","title":"HT Contact Form <= 2.10.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'form_data' Rich Text Field via Draft Save/Resume","severity":"HIGH","score":7.2,"vendor":"htplugins","product":"HT Contact Form – Drag & Drop Form Builder for WordPress","kev":false,"epss":0.00247,"kevAdded":null},{"id":"CVE-2026-7052","published":"2026-05-28T06:45:43.237Z","updated":"2026-05-28T10:33:10.091Z","title":"HT Contact Form <= 2.8.2 - Unauthenticated Stored Cross-Site Scripting via File Upload Field","severity":"HIGH","score":7.2,"vendor":"htplugins","product":"HT Contact Form – Drag & Drop Form Builder for WordPress","kev":false,"epss":0.00292,"kevAdded":null},{"id":"CVE-2026-1888","published":"2026-02-06T06:46:28.759Z","updated":"2026-04-08T16:37:14.375Z","title":"Docus <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"MEDIUM","score":6.4,"vendor":"htplugins","product":"Docus – YouTube Video Playlist","kev":false,"epss":0.00261,"kevAdded":null},{"id":"CVE-2025-13838","published":"2025-12-21T02:20:31.615Z","updated":"2026-04-08T16:51:40.521Z","title":"WishSuite <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button_text' Shortcode Attribute","severity":"MEDIUM","score":6.4,"vendor":"htplugins","product":"WishSuite – Wishlist for WooCommerce","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2025-14278","published":"2025-12-13T03:20:25.867Z","updated":"2026-04-08T17:15:33.724Z","title":"HT Slider for Elementor <= 1.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"MEDIUM","score":6.4,"vendor":"htplugins","product":"HT Slider For Elementor","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2025-12112","published":"2025-11-08T03:27:50.117Z","updated":"2026-04-08T17:34:11.156Z","title":"Insert Headers and Footers Code – HT Script <= 1.1.6 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"MEDIUM","score":6.4,"vendor":"htplugins","product":"Insert Headers and Footers Code – HT Script","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-7645","published":"2025-07-22T06:38:50.000Z","updated":"2026-04-08T17:05:26.662Z","title":"Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.2.8 - Unauthenticated Arbitrary File Deletion Triggered via Admin Form Submission Deletion","severity":"HIGH","score":8.1,"vendor":"htplugins","product":"Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection)","kev":false,"epss":0.00907,"kevAdded":null},{"id":"CVE-2025-7340","published":"2025-07-15T04:23:42.345Z","updated":"2026-04-08T17:32:19.145Z","title":"HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Upload","severity":"CRITICAL","score":9.8,"vendor":"htplugins","product":"HT Contact Form – Drag & Drop Form Builder for WordPress","kev":false,"epss":0.01751,"kevAdded":null},{"id":"CVE-2025-7360","published":"2025-07-15T04:23:41.923Z","updated":"2026-04-08T17:27:59.680Z","title":"HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Directory Traversal to Arbitrary File Move","severity":"CRITICAL","score":9.1,"vendor":"htplugins","product":"HT Contact Form – Drag & Drop Form Builder for WordPress","kev":false,"epss":0.01461,"kevAdded":null},{"id":"CVE-2025-7341","published":"2025-07-15T04:23:40.839Z","updated":"2026-04-08T16:45:25.485Z","title":"HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Deletion","severity":"CRITICAL","score":9.1,"vendor":"htplugins","product":"HT Contact Form – Drag & Drop Form Builder for WordPress","kev":false,"epss":0.0119,"kevAdded":null},{"id":"CVE-2025-2779","published":"2025-04-02T01:44:29.451Z","updated":"2026-04-08T17:01:23.121Z","title":"Insert Headers and Footers Code – HT Script <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update","severity":"MEDIUM","score":6.5,"vendor":"htplugins","product":"Insert Headers and Footers Code – HT Script","kev":false,"epss":0.00292,"kevAdded":null},{"id":"CVE-2024-10223","published":"2024-10-30T06:43:36.000Z","updated":"2026-04-08T16:44:39.333Z","title":"HT Team Member <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via htteamember Shortcode","severity":"MEDIUM","score":6.4,"vendor":"htplugins","product":"WP Team – WordPress Team Member Plugin","kev":false,"epss":0.00335,"kevAdded":null},{"id":"CVE-2024-1176","published":"2024-03-13T15:26:33.603Z","updated":"2026-04-08T16:36:08.059Z","title":"HT Easy GA4 – Google Analytics WordPress Plugin <= 1.1.5 - Missing Authorization to Unauthenticated GA4 Email Update","severity":"MEDIUM","score":5.3,"vendor":"htplugins","product":"HT Easy GA4 – Google Analytics WordPress Plugin","kev":false,"epss":0.00606,"kevAdded":null}]}