WordPress security by component
Ultimate Addons for Contact Form 7
Plugin description
Ultimate Addons for Contact Form 7 is a WordPress component with 15 published CVE records in this archive. The latest tracked vulnerability was published Jul 27, 2026; the highest CVE/CNA score is 8.8.
Plugin slug:
ultimate-addons-for-contact-form-7Latest vulnerability
CVE-2026-65439: Ultimate Addons for Contact Form 7 public input permits cross-site scripting
Ultimate Addons for Contact Form 7 through 3.5.45 accepts attacker-controlled input through an unauthenticated request path and places it into a browser-executable output context without adequate neutralization. A victim who opens the crafted output can run script in the site's origin. The Patchstack CNA record does not disclose whether the payload is reflected or stored, or identify the endpoint, action, parameter or rendering function.
| Safe version |
|
||
|---|---|---|---|
| Jul 27, 2026 |
CVE-2026-65439
Ultimate Addons for Contact Form 7 public input permits cross-site scripting
Ultimate Addons for Contact Form 7 through 3.5.45 accepts attacker-controlled input through an unauthenticated request path and places it into a browser-executable output context without adequate neutralization. A victim who opens the crafted output can run script in the site's origin. The Patchstack CNA record does not disclose whether the payload is reflected or stored, or identify the endpoint, action, parameter or rendering function.
|
3.5.46 |
CVE7.1
NVDPending
|
| Mar 13, 2026 |
CVE-2026-32460
Ultimate Addons for Contact Form 7: Cross-site scripting
Ultimate Addons for Contact Form 7 is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.5
NVDPending
|
| Feb 03, 2026 |
CVE-2026-24945
Ultimate Addons for Contact Form 7: A security weakness
Ultimate Addons for Contact Form 7 is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Dec 12, 2025 |
CVE-2025-14356
Ultra Addons for Contact Form 7: A security weakness
Ultra Addons for Contact Form 7 is affected by a security weakness. Exploitation requires at least subscriber-level access. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE4.3
NVDPending
|
| Jul 01, 2025 |
CVE-2025-6756
Ultra Addons for Contact Form 7: Cross-site scripting
Ultra Addons for Contact Form 7 is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| Jun 26, 2025 |
CVE-2025-6212
Ultra Addons for Contact Form 7: Cross-site scripting
Ultra Addons for Contact Form 7 is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE7.2
NVD6.1
|
| Jun 18, 2025 |
CVE-2025-6220
Ultra Addons for Contact Form 7: Dangerous file upload
Ultra Addons for Contact Form 7 is affected by dangerous file upload. Exploitation requires at least administrator-level access. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.
|
See mitigation notes |
CVE7.2
NVDPending
|
| Jan 02, 2025 |
CVE-2023-47693
Ultimate Addons for Contact Form 7: A security weakness
Ultimate Addons for Contact Form 7 is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE7.5
NVDPending
|
| Dec 20, 2023 |
CVE-2023-30495
Ultimate Addons for Contact Form 7: SQL injection
Ultimate Addons for Contact Form 7 is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE8.5
NVD8.1
|
| Dec 14, 2023 |
CVE-2023-49766
Ultimate Addons for Contact Form 7: Cross-site scripting
Ultimate Addons for Contact Form 7 is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE7.1
NVD6.1
|
| Sep 27, 2023 |
CVE-2023-30493
Ultimate Addons For Contact Form 7: Cross-site scripting
Ultimate Addons For Contact Form 7 is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE7.1
NVD6.1
|
| Aug 14, 2023 |
CVE-2023-2803
Ultimate Addons for Contact Form 7: Cross-site scripting
Ultimate Addons for Contact Form 7 is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.1
NVD6.1
|
| Aug 14, 2023 |
CVE-2023-2802
Ultimate Addons for Contact Form 7: Cross-site scripting
Ultimate Addons for Contact Form 7 is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE4.8
NVD4.8
|
| Jun 19, 2023 |
CVE-2022-47586
Ultimate Addons For Contact Form 7: SQL injection
Ultimate Addons For Contact Form 7 is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE8.2
NVD9.8
|
| Jun 09, 2023 |
CVE-2023-1615
Ultimate Addons for Contact Form 7: SQL injection
Ultimate Addons for Contact Form 7 is affected by SQL injection. Exploitation requires an authenticated WordPress account. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE8.8
NVD6.5
|