Ultra Addons for Contact Form 7 vulnerabilities | LiveThreat CVE Feed

Product

Ultra Addons for Contact Form 7

by themefic · last CVE Oct 16, 2026

CVEs

On KEV

9.8

Max CVSS

New 30D

Severity mix

Critical 1High 2Medium 4Low 0

Severity

Exploitation

Watch

Add Ultra Addons for Contact Form 7 to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-12801	6.4	0%	Aug 7	Ultra Addons for Contact Form 7 <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Attributes Affected: through 3.5.43
CVE-2025-6212	6.1	0%	Jun 26	Ultra Addons for Contact Form 7 3.5.11 - 3.5.19 - Unauthenticated Stored Cross-Site Scripting via Database module Affected: 3.5.11 through 3.5.19
CVE-2025-6756	5.4	0%	Jul 1	Ultra Addons for Contact Form 7 <= 3.5.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via UACF7_CUSTOM_FIELDS Shortcode Affected: through 3.5.21
CVE-2025-14356	4.3	0%	Dec 12	Ultra Addons for Contact Form 7 <= 3.5.33 - Missing Authorization to Authenticated (Subscriber+) to Generate Form Submission PDF Affected: through 3.5.33