Ultimate Addons for Contact Form 7 <= 3.5.50 - Arbitrary File Upload

Ultimate Addons for Contact Form 7 UACF7 = 3.5.50 copies every file submitted through a Contact Form 7 uacf7signature field into wp-content/uploads/uacf7-uploads/ with no file-type or extension validation when the PDF Generator module is enabled on the form. An unauthenticated attacker can POST t...

CVE-2026-125802

Insertion of Sensitive Information Into Sent Data vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Retrieve Embedded Sensitive Data.This issue affects Spectra: from n/a through 2.20.5...

EUVD-2026-125517

Insertion of Sensitive Information Into Sent Data vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Retrieve Embedded Sensitive Data.This issue affects Spectra: from n/a through 2.20.5...

CVE-2026-125802

The Brainstorm Force Spectra ultimate-addons-for-gutenberg WordPress plugin is affected by an Insertion of Sensitive Information Into Sent Data vulnerability (CWE-201). This issue allows an attacker to retrieve embedded sensitive data from the plugin. The vulnerability impacts Spectra versions fr...

CVE-2026-125802 WordPress Spectra plugin <= 2.20.5 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Retrieve Embedded Sensitive Data.This issue affects Spectra: from n/a through 2.20.5...

CVE-2026-125800

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Stored XSS.This issue affects Spectra: from n/a through 2.20.5...

CVE-2026-128834

Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through 2.20.5...

CVE-2026-125800

The WordPress Spectra plugin (also known as ultimate-addons-for-gutenberg by Brainstorm Force) versions 2.20.5 and below is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The vulnerability is caused by Improper Neutralization of Input During Web Page Generation (CWE-79), which allows an ...

CVE-2026-125800 WordPress Spectra plugin <= 2.20.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Stored XSS.This issue affects Spectra: from n/a through 2.20.5...

EUVD-2026-125295

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Stored XSS.This issue affects Spectra: from n/a through 2.20.5...

CVE-2026-128834

The Spectra WordPress plugin (specifically the ultimate-addons-for-gutenberg by Brainstorm Force) versions 2.20.5 and below is vulnerable to a Missing Authorization vulnerability (CWE-862 ). This flaw allows for the exploitation of incorrectly configured access control security levels. The impact...

EUVD-2026-125283

Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through 2.20.5...

CVE-2026-128834 WordPress Spectra plugin <= 2.20.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through 2.20.5...

PT-2026-146843

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Stored XSS.This issue affects Spectra: from n/a through 2.20.5...

PT-2026-146827

Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through 2.20.5...

PT-2026-146875

Insertion of Sensitive Information Into Sent Data vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Retrieve Embedded Sensitive Data.This issue affects Spectra: from n/a through 2.20.5...

CVE-2025-6220

Ultimate Addons for Contact Form 7 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo validlft forever preferredlft forever inet6 ::1/128 scope host validlft forever preferredlft forever 2: eth0...

WordPress Ultimate Addons for Elementor Forms plugin < 1.0.8 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Mike Gozdiskowski in WordPress Plugin Ultimate Addons for Elementor Forms versions 1.0.8...

CVE-2026-124814

The Ultimate Addons for Elementor Forms WordPress plugin before 1.0.8 does not properly validate the extension of uploaded files in its bundled file upload field, allowing unauthenticated users to upload arbitrary files such as PHP scripts and achieve remote code execution...

CVE-2026-124814

The Ultimate Addons for Elementor Forms WordPress plugin (versions before 1.0.8 ) is vulnerable to unauthenticated arbitrary file upload . The root cause is insufficient validation of file extensions within the plugin's bundled file upload field. Attackers can exploit this to upload malicious fil...