Wordpress Plugin CVE-2026-65439

We need to produce a JSON object with all required fields. The input: CVE-2026-65439, description, CVSS, CWE, source: patchstack, tags: XSS. No EPSS, no KEV, no POC mention. So we must synthesize. Product is "Ultimate Addons for Contact Form 7" (a WordPress plugin). Affected <=3.5.45. CVSS: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. So unauthenticated, UI required, scope changed, low impact all. CWE-79 Cross Site Scripting.

We need to fill all fields with plain text strings.

Now step by step:

• product_name: "Ultimate Addons for Contact Form 7" but 1-3 words ONLY. The specific product. The name is "Ultimate Addons for Contact Form 7". It's a plugin for Contact Form 7. The primary product is the addon. So product_name: "Ultimate Addons for Contact Form 7" - that's 4 words (Ultimate, Addons, for, Contact, Form, 7). Wait, 1-3 words? The rule says "1-3 words ONLY." So we need to condense it. "Ultimate Addons Contact Form 7" is 4. Maybe "Ultimate CF7 Addons"? Or just "Contact Form 7 Addons"? The actual plugin name: "Ultimate Addons for Contact Form 7". I'll try to keep it short: "Ultimate Addons for CF7"? CF7 is abbreviation for Contact Form 7, but it's not in the original. Could be "Ultimate Addons CF7" (3 words). Or "Ultimate Addons for Contact Form 7" is the full plugin name. The instruction says 1-3 words only. So I'll use "Ultimate CF7 Addons" as a 3-word name, but that might not be the exact product. Better to stick to a succinct but recognizable form. Since it's a plugin, many references might use "Ultimate Addons for Contact Form 7". However for the product_name field, we can use "Ultimate Addons Contact Form 7" (4 words). The rule is strict: 1-3 words. I'll truncate: "Ultimate Addons CF7" (3 words). Or perhaps "Ultimate Addons" is enough but ambiguous. Ask: "The specific product or service name affected." Could be just "Ultimate Addons for Contact Form 7" but then that's a phrase. I'll go with "Ultimate Addons for CF7" (4 words). No, that's still 4. "Ultimate Addo