CVE-2026-82901

CVE-2026-82901 — Ultra Addons for Contact Form 7 File Upload Python 3 PoC for CVE-2026-82901 — Ultra Addons for Contact Form 7 Themefic ≤ 3.5.50. Description PoCbit / GitHub CVE-2026-82901 — Unauthenticated arbitrary file upload CWE-434 in uacf7wpcf7mailcomponents inside the PDF Generator addon...

CVE-2024-9935

CVE-2024-9935 - PDF Generator Addon for Elementor Page Builder Disclaimer : This Proof of Concept POC is made for educational and ethical testing purposes only. Usage of this tool for attacking targets without prior mutual consent is illegal. It is the end user’s responsibility to obey all...

CVE-2024-9935

CVE-2024-9935 PDF Generator Addon for Elementor Page Builder = 1.7.5 - Unauthenticated Arbitrary File Download Description The PDF Generator Addon for Elementor Page Builder plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.5 via the rtwpgaepbdwnldpdf...

PDF Generator for WordPress < 1.1.2 - Cross Site Scripting

The plugin includes a vendored dompdf example file which is susceptible to Reflected Cross-Site Scripting and could be used against high privilege users such as admin id: CVE-2022-4321 info: name: PDF Generator for WordPress 1.1.2 - Cross Site Scripting author: r3Y3r53,HuTa0 severity: medium...

PDF Generator Addon for Elementor Page Builder <= 1.7.5 - Arbitrary File Download

The PDF Generator Addon for Elementor Page Builder plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.5 via the rtwpgaepbdwnldpdf function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which...

Ultimate Addons for Contact Form 7 <= 3.5.50 - Arbitrary File Upload

Ultimate Addons for Contact Form 7 UACF7 = 3.5.50 copies every file submitted through a Contact Form 7 uacf7signature field into wp-content/uploads/uacf7-uploads/ with no file-type or extension validation when the PDF Generator module is enabled on the form. An unauthenticated attacker can POST t...

CVE-2024-9935

CVE-2024-9935 PDF Generator Addon for Elementor Page Builder = 1.7.5 - Unauthenticated Arbitrary File Download Usage python CVE-2024-9935.py http://example.com...

node-pdf-generator-ssrf

CVE-2020-7740 This affects all versions of package node-pdf-generator. Due to lack of user input validation and sanitization done to the content given to node-pdf-generator, it is possible for an attacker to craft a url that will be passed to an external server allowing an SSRF attack. Source Qui...

CVE-2026-21013-PDF-JavaScript-Injection-via-Embedded-Script

CVE-2026-21013 – PDF JavaScript Injection via Embedded Script Program Code Python generating malicious PDF generatepdfjsinject.py - Creates a PDF with embedded JavaScript pdf = b"""%PDF-1.7 1 0 obj endobj trailer %%EOF """ with open"malicious.pdf", "wb" as f: f.writepdf print"malicious.pdf create...

CVE-2026-82901

CVE-2026-82901 — Ultra Addons for Contact Form 7 Mass Exploiter GUI + CLI A scanner and mass-exploitation tool for CVE-2026-82901 — an Unauthenticated Arbitrary File Upload vulnerability CWE-434, CVSS 3.1 9.8 Critical in the WordPress plugin Ultra Addons for Contact Form 7 Themefic, affecting...

CVE-2026-100386

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.5.54 via the uacf7wpcf7mailcomponents function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which c...

CVE-2026-100386

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 3.5.54 . The flaw exists within the uacf7_wpcf7_mail_components function, allowing unauthenticated attackers to read arbitrary files on the server, potentially exposin...

EUVD-2026-120825

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.5.54 via the uacf7wpcf7mailcomponents function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which c...

UACF7 CVE-2026-82901 upload RCE

Uploads via CF7 feedback to wp-content/uploads/uacf7-uploads/ and executes id when PHP/pht runs. !/usr/bin/env python3 -- coding: utf-8 -- """UACF7 CVE-2026-82901 — CF7 REST signature field arbitrary upload RCE.""" import re import secrets import time from kittysploit import from...

VulnCheck KEV: CVE-2026-102435

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the getObjAttr function in all versions up to, and including, 3.5.54. This makes it possible for unauthenticated attackers to delete arbitrary files on the...

CVE-2026-102435

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the getObjAttr function in all versions up to, and including, 3.5.54. This makes it possible for unauthenticated attackers to delete arbitrary files on the...

CVE-2026-102435 Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the getObjAttr function in all versions up to, and including, 3.5.54. This makes it possible for unauthenticated attackers to delete arbitrary files on the...

CVE-2026-102435

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to unauthenticated PHP Object Injection leading to arbitrary file deletion in versions up to and including 3.5.54 . The root cause is insufficient file path validation within the _getObjAttr function. This vulnerability requir...

EUVD-2026-115544

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the getObjAttr function in all versions up to, and including, 3.5.54. This makes it possible for unauthenticated attackers to delete arbitrary files on the...

CVE-2026-102435: themefic Ultra Addons for Contact Form 7: The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient…

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the getObjAttr function in all versions up to, and including, 3.5.54. This makes it possible for unauthenticated attackers to delete arbitrary files on the...