Ultimate Addons CF7 CVE-2026-95586

Exploitation requires an authenticated account with at least Contributor privileges on a WordPress site running Ultimate Addons for Contact Form 7 <= 3.5.50 (PR:L), plus subsequent user interaction (UI:R) - a higher-privileged user such as an admin or editor must view the attacker-injected content for the stored script to execute. This limits realistic impact to sites that allow untrusted Contributor-level registration; it is not exploitable pre-authentication or against a site where no privileged user renders the malicious content.

This is a moderate-priority, not high-priority, issue. The CVSS 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) rests on network vector but is materially gated by PR:L and UI:R: the attacker must already hold a Contributor-level account on the target WordPress site, and an admin/editor must subsequently view the injected content for the script to fire. The scope change (S:C) reflects that a Contributor-stored payload executes in a higher-privileged user's browser (the classic WP admin-context XSS boundary crossing), which is the main reason this scores above 5. No EPSS score, no CISA KEV listing, and no public POC are provided - exploitation status is therefore 'no public exploit identified at time of analysis,' meaning this is not evidence of widespread or automated exploitation. I question the A:L component: a reflected/stored XSS of this class does not credibly degrade availability, so a defensible vector is A:N, dropping the real score to roughly 6.4. Net: a real but authenticated, interaction-dependent flaw - patch it in routine cycles, not as an emergency.

An attacker who has registered or obtained a Contributor account on a WordPress site running Ultimate Addons for Contact Form 7 <= 3.5.50 injects a malicious script payload into a plugin-controlled field. When an administrator or editor later views that content in wp-admin, the script executes in their authenticated browser session, enabling actions such as session/cookie theft or forged admin requests. No public POC or active exploitation is reported at time of analysis.