Ultra Addons for Contact Form 7 vulnerabilities | LiveThreat CVE Feed

Product

Ultra Addons for Contact Form 7

by themefic · last CVE Oct 16, 2026

CVEs

On KEV

9.8

Max CVSS

New 30D

Severity mix

Critical 1High 2Medium 4Low 0

Severity

Exploitation

Watch

Add Ultra Addons for Contact Form 7 to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-82901	9.8	4%	Sep 26	Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field Affected: through 3.5.50
CVE-2026-103999	7.2	0%	Oct 16	Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Stored Cross-Site Scripting via File Upload Affected: through 3.5.54
CVE-2025-6220	7.2	1%	Jun 18	Ultimate Addons for Contact Form 7 <= 3.5.12 - Authenticated (Administrator+) Arbitrary File Upload via 'save_options' Affected: through 3.5.12
CVE-2026-12801	6.4	0%	Aug 7	Ultra Addons for Contact Form 7 <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Attributes Affected: through 3.5.43
CVE-2025-6212	6.1	0%	Jun 26	Ultra Addons for Contact Form 7 3.5.11 - 3.5.19 - Unauthenticated Stored Cross-Site Scripting via Database module Affected: 3.5.11 through 3.5.19
CVE-2025-6756	5.4	0%	Jul 1	Ultra Addons for Contact Form 7 <= 3.5.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via UACF7_CUSTOM_FIELDS Shortcode Affected: through 3.5.21
CVE-2025-14356	4.3	0%	Dec 12	Ultra Addons for Contact Form 7 <= 3.5.33 - Missing Authorization to Authenticated (Subscriber+) to Generate Form Submission PDF Affected: through 3.5.33