HT Contact Form – Drag & Drop Form Builder for WordPress Security & Risk Analysis

The ht-contactform v2.8.2 plugin presents a mixed security posture. On one hand, it demonstrates good practices in its use of prepared statements for SQL queries (91%) and proper output escaping (90%), which are crucial for preventing common web vulnerabilities. The presence of numerous capability checks (29) also suggests an effort to enforce permissions. However, the static analysis reveals a significant concern: one AJAX handler lacks authentication checks, creating a direct attack vector. While the taint analysis shows no critical or high severity flows, two flows with unsanitized paths warrant attention as they could potentially lead to path traversal or include/require vulnerabilities if exploited in conjunction with other weaknesses.

The plugin's vulnerability history is a major red flag. With six known CVEs, including three critical ones, and a recent vulnerability in July 2025, the historical pattern indicates a recurring struggle with security. Common vulnerability types like Remote File Inclusion, Unrestricted Upload, Path Traversal, Improper Privilege Management, XSS, and CSRF suggest fundamental security flaws have been present in the past. While there are currently no unpatched CVEs, this history implies a higher likelihood of future vulnerabilities and suggests that past fixes may not have addressed root causes effectively.

In conclusion, while the plugin exhibits some positive security development practices, the untrusted AJAX entry point, potential unsanitized paths, and a problematic vulnerability history significantly increase its risk profile. The plugin's reliance on an outdated bundled library (Guzzle v1.1) further contributes to potential security weaknesses. Users should proceed with extreme caution and consider alternatives if possible.