Ultra Addons For Contact Form 7
Monthly
Stored Cross-Site Scripting in the Ultra Addons for Contact Form 7 WordPress plugin (all versions through 3.5.43) permits authenticated contributors to inject persistent malicious scripts via the Range Slider widget's 'data-label' and 'data-separator' attributes. The Scope:Changed CVSS metric confirms that once injected, the payload executes in the security context of any user who subsequently visits the affected page - including administrators - enabling session hijacking, credential theft, or admin-level action forgery. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in the Ultra Addons for Contact Form 7 WordPress plugin (all versions through 3.5.43) permits authenticated contributors to inject persistent malicious scripts via the Range Slider widget's 'data-label' and 'data-separator' attributes. The Scope:Changed CVSS metric confirms that once injected, the payload executes in the security context of any user who subsequently visits the affected page - including administrators - enabling session hijacking, credential theft, or admin-level action forgery. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.