CVE-2026-96326 is a stored cross-site scripting vulnerability (CWE-79) in the HT Contact Form – Drag & Drop Form Builder for WordPress plugin. The flaw arises due to insufficient input sanitization and output escaping in the Rich Text Editor Field, enabling unauthenticated attackers to inject arbitrary web scripts. This vulnerability affects all plugin versions from 0 up to and including 2.10.2.

An unauthenticated attacker can exploit this vulnerability to inject malicious scripts that execute in the context of users viewing the affected pages. This can lead to information disclosure and integrity impacts, such as theft of user credentials or session tokens. The CVSS 3.1 base score is 7.2 (high severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact on confidentiality and integrity with no impact on availability.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or restricting use of the Rich Text Editor Field in the plugin or applying web application firewall rules to detect and block XSS payloads targeting this plugin.