CVE-2026-93303 describes a stored DOM-based Cross-Site Scripting vulnerability in the HT Contact Form – Drag & Drop Form Builder for WordPress plugin. The issue arises from insufficient input sanitization and output escaping of the 'form_data' Rich Text Field during the Draft Save/Resume process. Attackers can exploit this by tricking users into clicking a specially crafted draft resume URL that includes the draft_key and access_token, enabling script injection and execution in the context of the victim's browser session.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of users who access the malicious draft resume URL. This can lead to partial confidentiality and integrity loss (as indicated by the CVSS vector), such as theft of sensitive information or manipulation of page content. There is no indication of availability impact. The vulnerability requires no user interaction beyond clicking a crafted URL.

No vendor advisory or patch information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid clicking untrusted draft resume URLs and consider restricting access to draft resume features if possible.