What is the CVSS score of CVE-2026-12801?

CVE-2026-12801 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Ultra Addons CF7 CVE-2026-12801

EUVD-2026-54365 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-07 Wordfence

GHSA-vg95-f6hv-9qwv

WordPress XSS Wordpress Plugin Ultra Addons For Contact Form 7 Themefic

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

UI:R assigned independently because a victim must navigate to the injected page; all other metrics align with contributor-authenticated stored XSS with scope change.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 05:22 vuln.today

CVE Published

Aug 07, 2026 - 04:25 nvd

MEDIUM 6.4

DescriptionCVE.org

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Range Slider 'data-label' and 'data-separator' attributes in all versions up to, and including, 3.5.43 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Ultra Addons for Contact Form 7 WordPress plugin (all versions through 3.5.43) permits authenticated contributors to inject persistent malicious scripts via the Range Slider widget's 'data-label' and 'data-separator' attributes. The Scope:Changed CVSS metric confirms that once injected, the payload executes in the security context of any user who subsequently visits the affected page - including administrators - enabling session hijacking, credential theft, or admin-level action forgery. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

The vulnerable component is the Range Slider add-on bundled with the Ultra Addons for Contact Form 7 plugin (CPE: cpe:2.3:a:themefic:ultra_addons_for_contact_form_7:*:*:*:*:*:*:*:*) by Themefic, a WordPress plugin that extends Contact Form 7 with additional UI components. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - 'Cross-site Scripting'), specifically the stored/persistent variant: user-supplied values for the HTML attributes 'data-label' and 'data-separator' on the Range Slider widget are written to the database and later rendered into page output without adequate sanitization or escaping. The WordPress trac changeset (3586004) targets range-slider.js, suggesting the flaw involves client-side attribute reflection from stored server data rather than pure server-side templating. The Scope:Changed (S:C) metric in the CVSS vector is appropriate: the vulnerable system is the WordPress server/plugin, while the impact materializes in a separate security context - the victim's browser - consistent with standard XSS scope-change scoring.

RemediationAI

An upstream fix has been committed to the plugin's WordPress Subversion repository in changeset 3586004 (https://plugins.trac.wordpress.org/changeset/3586004/ultimate-addons-for-contact-form-7/trunk/addons/range-slider/js/range-slider.js); however, the exact released plugin version containing this fix is not independently confirmed from the available intelligence - verify against the WordPress plugin repository and update to the latest available version exceeding 3.5.43. As a compensating control pending update, site administrators can restrict contributor-level access or disable the Range Slider widget feature within the plugin settings, accepting the trade-off of reduced form-builder functionality. Additionally, enabling a Web Application Firewall rule targeting XSS payloads in form widget attribute fields (available through Wordfence or equivalent WAF solutions) can block exploitation attempts without requiring downtime. Review existing pages for unexpected script content in Range Slider widget attributes as part of post-discovery cleanup.