CVE-2025-7340criticalobserved exploitationCWE-434

CVE-2025-7340: critical vulnerability in htplugins HT Contact Form – Drag & Drop Form…

HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Upload

Published · Updated

Follow this CVE+ Monitor HT Contact Form – Drag & Drop Form Builder for WordPress

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

70Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck and has a public proof of concept.

ssvc Actcvss 9.8epss 1.8%
from disclosure to weaponsame day
Published on NVDJul 15
1st PoCJul 14
VulnCheck+293d
The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the temp_file_upload() function in all versions up to, and including, 2.2.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
htplugins · HT Contact Form – Drag & Drop Form Builder for WordPress
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — htplugins HT Contact Form – Drag & Drop Form…

In the same product, most dangerous first.

CVE-2025-7360CRITICALHT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Directory Traversal to Arbitrary File MoveEPSS 1.5%CVE-2025-7341CRITICALHT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File DeletionEPSS 1.2%CVE-2026-7052HIGHHT Contact Form <= 2.8.2 - Unauthenticated Stored Cross-Site Scripting via File Upload FieldEPSS 0.3%CVE-2026-93303HIGHHT Contact Form <= 2.10.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'form_data' Rich Text Field via Draft Save/ResumeEPSS 0.2%CVE-2026-96326HIGHHT Contact Form – Drag & Drop Form Builder for WordPress <= 2.10.2 Unauthenticated Stored Cross-Site Scripting via Rich Text Editor FieldEPSS 0.2%