Ultra Addons for Contact Form 7 vulnerabilities | LiveThreat CVE Feed

Product

Ultra Addons for Contact Form 7

by themefic · last CVE Oct 16, 2026

CVEs

On KEV

9.8

Max CVSS

New 30D

Severity mix

Critical 1High 2Medium 4Low 0

Severity

Exploitation

Watch

Add Ultra Addons for Contact Form 7 to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-103999	7.2	0%	Oct 16	Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Stored Cross-Site Scripting via File Upload Affected: through 3.5.54
CVE-2025-6220	7.2	1%	Jun 18	Ultimate Addons for Contact Form 7 <= 3.5.12 - Authenticated (Administrator+) Arbitrary File Upload via 'save_options' Affected: through 3.5.12