Ultra Addons for Contact Form 7 EUVD-2026-102660

Exploitation requires the target WordPress site to run this plugin's file-upload/database add-on feature on a Contact Form 7 form, since that upload handler is the injection point. The specific bypass condition: the attacker must upload a file bearing an allowed text extension (.txt, .csv, .vtt, .srt, .asc) whose byte content begins with an HTML payload (e.g., '<BODY onload=…>'), exploiting that the blocklist gatekeeper classifies such files as text/plain by extension without inspecting content. Per CVSS PR:N, no authentication is required. The practical limiting factor is that the stored payload only executes when a user subsequently loads the injected page, and only sites that both run the plugin and expose its upload feature are affected - so the flaw does not apply to default WordPress or to deployments not using this add-on's upload function.

This is a credible, moderate-priority web vulnerability rather than an emergency. The source (Wordfence) is a reputable WordPress vulnerability authority, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C, score 7.2) describes a network-reachable, low-complexity flaw requiring no privileges and no user interaction to inject, with a scope change reflecting that the payload executes in the browser context of other users. Exploitation status is 'no public exploit identified at time of analysis' - the input contains no CISA KEV listing, no POC flag, and no EPSS probability, so there is no evidence of active or automated exploitation; the absence of EPSS means widespread-exploitation likelihood cannot be quantified from this data. Impact is bounded: confidentiality and integrity are rated Low and availability None, consistent with stored XSS (session/cookie theft, admin-action forgery, content defacement in the victim's browser) rather than direct server compromise. The real-world risk is tempered by the fact that the flaw only matters on sites actually using this specific add-on's file-upload/database feature, and the stored payload still requires a victim to load the injected page before it fires. Net: a genuine unauthenticated stored XSS worth patching promptly on affected sites, but not a drop-everything issue absent evidence of exploitation.

An unauthenticated attacker submits a Contact Form 7 form handled by this plugin and attaches a file with a permitted text extension (e.g., payload.txt) whose contents begin with an HTML payload such as '<BODY onload=alert(document.cookie)>'. Because the gatekeeper classifies the upload as text/plain by extension without inspecting byte content, the file is stored and later rendered on a plugin-generated page, and the script executes in the browser of any user - including a logged-in administrator - who views that page. No public exploit code is identified at time of analysis, but the technique is fully described in the advisory.