Ultimate Addons for Contact Form 7 vulnerabilities

Product

Ultimate Addons for Contact Form 7

by Themefic · last CVE Sep 30, 2026

CVEs

On KEV

9.8

Max CVSS

New 30D

Severity mix

Critical 1High 5Medium 10Low 0

Severity

Exploitation

Watch

Add Ultimate Addons for Contact Form 7 to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2023-30495	8.1	1%	Dec 20	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Ultimate Addons for Contact Form 7.This issue affects Ultimate… Affected: before 3.1.24
CVE-2023-47693	7.5	1%	Jan 2	WordPress Ultimate Addons for Contact Form 7 plugin <= 3.2.6 - Broken Access Control vulnerability Affected: through 3.2.6
CVE-2026-96833	7.2	0%	Sep 30	WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.51 - PHP Object Injection vulnerability Affected: through 3.5.51
CVE-2025-6220	7.2	1%	Jun 18	Ultimate Addons for Contact Form 7 <= 3.5.12 - Authenticated (Administrator+) Arbitrary File Upload via 'save_options' Affected: before 3.5.13
CVE-2026-65439	7.1	0%	Jul 27	WordPress Ultimate Addons for Contact Form 7 plugin <=3.5.45 - Cross Site Scripting (XSS) vulnerability Affected: through 3.5.45