CVE-2025-6756

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's UACF7CUSTOMFIELDS shortcode in all versions up to, and including, 3.5.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2025-6756

creationtimestamp| type| source ---|---|--- 2025-07-01 10:08:37+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/20013 2025-07-01 13:37:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lsvszxj5tu2u...

CVE-2025-6756

CVE-2025-6756 concerns Ultra Addons for Contact Form 7 (WordPress). The vulnerability is a Stored Cross-Site Scripting flaw in the UACF7_CUSTOM_FIELDS shortcode, arising from insufficient input sanitization and output escaping for user-supplied attributes. Exploitation requires authentication at ...

CVE-2025-6756 Ultra Addons for Contact Form 7 <= 3.5.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via UACF7_CUSTOM_FIELDS Shortcode

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's UACF7CUSTOMFIELDS shortcode in all versions up to, and including, 3.5.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

WordPress Ultra Addons for Contact Form 7 plugin <= 3.5.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via UACF7_CUSTOM_FIELDS Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via UACF7CUSTOMFIELDS Shortcode vulnerability discovered by muhammad yudha in WordPress Plugin Ultimate Addons for Contact Form 7 versions = 3.5.21...