Ultimate Addons For Contact Form 7
Monthly
PHP object injection in the Themefic Ultimate Addons for Contact Form 7 WordPress plugin (versions through 3.5.51) allows an authenticated user holding the Editor role to feed crafted serialized data into a plugin code path that calls PHP's unserialize, which can lead to code execution, file operations, or data tampering if a viable POP gadget chain exists in the plugin or elsewhere on the site. The issue is network-reachable and needs no user interaction, but exploitation is access-gated by the Editor-privilege prerequisite, and no public exploit code has been identified at time of analysis; EPSS data was not provided.
Stored cross-site scripting in Ultimate Addons for Contact Form 7 (all versions through 3.5.50) allows an authenticated user with Contributor-level access to inject script into plugin-rendered content that later executes in the browser of a higher-privileged user such as an administrator or editor who views that content. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 6.5 per the vendor score) requires both a low-privileged account and victim interaction, so realistic exposure is limited to WordPress sites that grant Contributor accounts to untrusted parties; there is no identified pre-authentication path. No public exploit code and no CISA KEV entry were identified at time of analysis, making this a moderate-priority rather than high-priority issue, though the scope-change characteristic means injected script can act outside the plugin's own origin context within the site.
Stored cross-site scripting in Ultimate Addons for Contact Form 7 through version 3.5.36 allows authenticated attackers with improper access controls to inject malicious scripts that execute in other users' browsers. An attacker can exploit this vulnerability to steal session tokens, modify form data, or perform actions on behalf of victims. No patch is currently available for this vulnerability.
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's UACF7_CUSTOM_FIELDS shortcode in all versions up to, and including, 3.5.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Database module in versions 3.5.11 to 3.5.19 due to insufficient input sanitization and output escaping. The unfiltered field names are stored alongside the sanitized values. Later, the admin-side AJAX endpoint ajax_get_table_data() returns those raw names as JSON column headers, and the client-side DataTables renderer injects them directly into the DOM without any HTML encoding. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
A remote code execution vulnerability in all (CVSS 7.2). Risk factors: public PoC available. Vendor patch is available.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Ultimate Addons for Contact Form 7.1.23. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Ultimate Addons for Contact Form 7 allows Stored XSS.2.0. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Ultimate Addons for Contact Form 7 plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in versions up to, and including, 3.1.23. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
PHP object injection in the Themefic Ultimate Addons for Contact Form 7 WordPress plugin (versions through 3.5.51) allows an authenticated user holding the Editor role to feed crafted serialized data into a plugin code path that calls PHP's unserialize, which can lead to code execution, file operations, or data tampering if a viable POP gadget chain exists in the plugin or elsewhere on the site. The issue is network-reachable and needs no user interaction, but exploitation is access-gated by the Editor-privilege prerequisite, and no public exploit code has been identified at time of analysis; EPSS data was not provided.
Stored cross-site scripting in Ultimate Addons for Contact Form 7 (all versions through 3.5.50) allows an authenticated user with Contributor-level access to inject script into plugin-rendered content that later executes in the browser of a higher-privileged user such as an administrator or editor who views that content. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 6.5 per the vendor score) requires both a low-privileged account and victim interaction, so realistic exposure is limited to WordPress sites that grant Contributor accounts to untrusted parties; there is no identified pre-authentication path. No public exploit code and no CISA KEV entry were identified at time of analysis, making this a moderate-priority rather than high-priority issue, though the scope-change characteristic means injected script can act outside the plugin's own origin context within the site.
Stored cross-site scripting in Ultimate Addons for Contact Form 7 through version 3.5.36 allows authenticated attackers with improper access controls to inject malicious scripts that execute in other users' browsers. An attacker can exploit this vulnerability to steal session tokens, modify form data, or perform actions on behalf of victims. No patch is currently available for this vulnerability.
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's UACF7_CUSTOM_FIELDS shortcode in all versions up to, and including, 3.5.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Database module in versions 3.5.11 to 3.5.19 due to insufficient input sanitization and output escaping. The unfiltered field names are stored alongside the sanitized values. Later, the admin-side AJAX endpoint ajax_get_table_data() returns those raw names as JSON column headers, and the client-side DataTables renderer injects them directly into the DOM without any HTML encoding. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
A remote code execution vulnerability in all (CVSS 7.2). Risk factors: public PoC available. Vendor patch is available.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Ultimate Addons for Contact Form 7.1.23. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Ultimate Addons for Contact Form 7 allows Stored XSS.2.0. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Ultimate Addons for Contact Form 7 plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in versions up to, and including, 3.1.23. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.