Ultra Addons For Contact Form 7
Monthly
Stored cross-site scripting in the Ultra Addons for Contact Form 7 WordPress plugin (all versions up to and including 3.5.54) lets unauthenticated attackers upload a text-type file whose contents begin with HTML markup, which is then persisted and executed in the browser of any user who later views the injected page - a classic CWE-79 stored XSS. Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (7.2), no authentication or user interaction is needed to deliver the payload, though execution depends on a victim subsequently loading the affected page. Exploitation is only reachable on sites that run the plugin and expose its file-upload/database add-on on a Contact Form 7 form; there is no public exploit identified at time of analysis and the issue is not in CISA KEV, so this is a credible moderate-priority web flaw rather than an emergency.
Unauthenticated arbitrary file upload in the WordPress plugin Ultra Addons for Contact Form 7 (themefic) affects every version up to and including 3.5.50, allowing a remote attacker to place arbitrary files - including executable PHP - on the web server because the 'uacf7_wpcf7_mail_components' handler performs insufficient file-type validation. Successful exploitation requires the plugin's PDF Generator module to be explicitly enabled; that module is off by default, so default installations are not vulnerable, and RCE further depends on the uploaded file landing in a web-executable path. Vendor/NVD rates this 9.8 (AV:N/AC:L/PR:N/UI:N), while our assessment raises complexity to AC:H precisely because of that non-default module prerequisite; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Unauthenticated arbitrary file upload in the Ultra Addons for Contact Form 7 WordPress plugin (versions 3.2.4 through before 3.5.51) lets a remote attacker place a file with an attacker-chosen name and extension at a predictable public path inside the WordPress site. On hosts running the default Debian/Ubuntu Apache PHP package configuration, where .phar is mapped to the PHP handler alongside .php and .phtml, that uploaded file is interpreted and the issue escalates to remote code execution and full site takeover; on hosts that route only .php to PHP, the file is served inert from the site's own origin, degrading the outcome to stored cross-site scripting. No authentication, user interaction, or special access is required (our assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), publicly available exploit code exists, and the RCE path is immediate on affected Apache/mod_php stacks - which is why our independent assessment rates real-world severity above the vendor-assigned CVSS 6.5.
Stored Cross-Site Scripting in the Ultra Addons for Contact Form 7 WordPress plugin (all versions through 3.5.43) permits authenticated contributors to inject persistent malicious scripts via the Range Slider widget's 'data-label' and 'data-separator' attributes. The Scope:Changed CVSS metric confirms that once injected, the payload executes in the security context of any user who subsequently visits the affected page - including administrators - enabling session hijacking, credential theft, or admin-level action forgery. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Stored cross-site scripting in the Ultra Addons for Contact Form 7 WordPress plugin (all versions up to and including 3.5.54) lets unauthenticated attackers upload a text-type file whose contents begin with HTML markup, which is then persisted and executed in the browser of any user who later views the injected page - a classic CWE-79 stored XSS. Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (7.2), no authentication or user interaction is needed to deliver the payload, though execution depends on a victim subsequently loading the affected page. Exploitation is only reachable on sites that run the plugin and expose its file-upload/database add-on on a Contact Form 7 form; there is no public exploit identified at time of analysis and the issue is not in CISA KEV, so this is a credible moderate-priority web flaw rather than an emergency.
Unauthenticated arbitrary file upload in the WordPress plugin Ultra Addons for Contact Form 7 (themefic) affects every version up to and including 3.5.50, allowing a remote attacker to place arbitrary files - including executable PHP - on the web server because the 'uacf7_wpcf7_mail_components' handler performs insufficient file-type validation. Successful exploitation requires the plugin's PDF Generator module to be explicitly enabled; that module is off by default, so default installations are not vulnerable, and RCE further depends on the uploaded file landing in a web-executable path. Vendor/NVD rates this 9.8 (AV:N/AC:L/PR:N/UI:N), while our assessment raises complexity to AC:H precisely because of that non-default module prerequisite; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Unauthenticated arbitrary file upload in the Ultra Addons for Contact Form 7 WordPress plugin (versions 3.2.4 through before 3.5.51) lets a remote attacker place a file with an attacker-chosen name and extension at a predictable public path inside the WordPress site. On hosts running the default Debian/Ubuntu Apache PHP package configuration, where .phar is mapped to the PHP handler alongside .php and .phtml, that uploaded file is interpreted and the issue escalates to remote code execution and full site takeover; on hosts that route only .php to PHP, the file is served inert from the site's own origin, degrading the outcome to stored cross-site scripting. No authentication, user interaction, or special access is required (our assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), publicly available exploit code exists, and the RCE path is immediate on affected Apache/mod_php stacks - which is why our independent assessment rates real-world severity above the vendor-assigned CVSS 6.5.
Stored Cross-Site Scripting in the Ultra Addons for Contact Form 7 WordPress plugin (all versions through 3.5.43) permits authenticated contributors to inject persistent malicious scripts via the Range Slider widget's 'data-label' and 'data-separator' attributes. The Scope:Changed CVSS metric confirms that once injected, the payload executes in the security context of any user who subsequently visits the affected page - including administrators - enabling session hijacking, credential theft, or admin-level action forgery. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.