Ultra Addons CF7 EUVD-2026-54365

Exploitation requires an authenticated WordPress user account at contributor privilege level or above on the target site. The Ultra Addons for Contact Form 7 plugin must be installed, active, and the Range Slider add-on specifically must be in use on at least one published or accessible page or post. The attacker must have the capability to create or edit content that includes the Range Slider widget - this is standard for contributor-level roles in WordPress. Exploitation is limited to installations where the plugin is active and where contributor or higher accounts exist beyond the site owner; tightly controlled single-administrator sites or those with no open registration and no shared authoring present a significantly lower realistic risk. Victims need only visit a page containing the injected widget for the payload to fire - no additional user interaction beyond normal page navigation is required post-injection.

The reported CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) rates this as Medium severity. The PR:L metric accurately reflects the contributor-level authentication requirement, which is the primary friction for exploitation - contributor accounts are common in multi-author WordPress sites (blogs, news sites, agencies) and can sometimes be obtained through registration or social engineering. The UI:N assignment is Wordfence's standard practice for stored XSS, treating it as requiring no additional victim interaction beyond normal page visits; this is a common scoring convention but is debated, as some frameworks score UI:R since a victim must browse to the affected page. No EPSS score was provided in the intelligence package; however, the contributor-level access requirement limits automated mass exploitation compared to unauthenticated flaws, suggesting real-world EPSS would likely fall below 0.1. The absence of KEV listing and no reported POC corroborate a lower-than-CVSS urgency in practice. For WordPress sites with open contributor registration or shared authoring environments, risk is meaningfully higher than for tightly controlled single-author deployments.

An attacker with a contributor account on a multi-author WordPress site navigates to the page/post editor, inserts a Contact Form 7 block using the Range Slider add-on, and sets the 'data-label' attribute to a crafted JavaScript payload. The malicious content is stored in the database; when any user - including a site administrator - subsequently loads the affected page, the script executes in their browser, enabling the attacker to steal session cookies, forge administrative actions, or redirect victims to phishing infrastructure. No public exploit code is known to exist at time of analysis.