373 matches found
Ultimate Addons for Contact Form 7 <= 3.5.50 - Arbitrary File Upload
Ultimate Addons for Contact Form 7 UACF7 = 3.5.50 copies every file submitted through a Contact Form 7 uacf7signature field into wp-content/uploads/uacf7-uploads/ with no file-type or extension validation when the PDF Generator module is enabled on the form. An unauthenticated attacker can POST t...
CVE-2026-39739
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brainstorm Force Ultimate Addons for Elementor - Lite header-footer-elementor allows Stored XSS.This issue affects Ultimate Addons for Elementor - Lite: from n/a through 2.9.5...
EUVD-2026-114273
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brainstorm Force Ultimate Addons for Elementor - Lite header-footer-elementor allows Stored XSS.This issue affects Ultimate Addons for Elementor - Lite: from n/a through 2.9.5...
CVE-2026-39739 WordPress Ultimate Addons for Elementor - Lite plugin <= 2.9.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brainstorm Force Ultimate Addons for Elementor - Lite header-footer-elementor allows Stored XSS.This issue affects Ultimate Addons for Elementor - Lite: from n/a through 2.9.5...
CVE-2026-39739
The WordPress Ultimate Addons for Elementor - Lite plugin (versions
CVE-2026-39739 WordPress Ultimate Addons for Elementor - Lite plugin <= 2.9.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brainstorm Force Ultimate Addons for Elementor - Lite header-footer-elementor allows Stored XSS.This issue affects Ultimate Addons for Elementor - Lite: from n/a through 2.9.5...
WordPress Ultimate Addons for Elementor - Lite plugin <= 2.9.5 - Cross Site Scripting (XSS) vulnerability
WordPress Ultimate Addons for Elementor - Lite plugin = 2.9.5 - Cross Site Scripting XSS vulnerability discovered by fccsec.dev in WordPress Plugin Ultimate Addons for Elementor - Lite versions = 2.9.5...
CVE-2025-6220
Ultimate Addons for Contact Form 7 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo validlft forever preferredlft forever inet6 ::1/128 scope host validlft forever preferredlft forever 2: eth0...
CVE-2026-39739: Brainstorm Force Ultimate Addons for Elementor - Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force…
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brainstorm Force Ultimate Addons for Elementor - Lite header-footer-elementor allows Stored XSS.This issue affects Ultimate Addons for Elementor - Lite: from n/a through 2.9.5...
VulnCheck KEV: CVE-2026-15382
The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.4 does not perform a capability or nonce check before deleting a site's custom-uploaded icon font packs, allowing unauthenticated attackers to permanently delete all of a site's custom icon fonts with a single request...
CVE-2026-96833
Editor PHP Object Injection in Ultimate Addons for Contact Form 7 = 3.5.51 versions...
CVE-2026-96833 WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.51 - PHP Object Injection vulnerability
Editor PHP Object Injection in Ultimate Addons for Contact Form 7 = 3.5.51 versions...
CVE-2026-96833 WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.51 - PHP Object Injection vulnerability
Editor PHP Object Injection in Ultimate Addons for Contact Form 7 = 3.5.51 versions...
EUVD-2026-89885
Editor PHP Object Injection in Ultimate Addons for Contact Form 7 = 3.5.51 versions...
CVE-2026-96833
The Ultimate Addons for Contact Form 7 WordPress plugin, specifically versions
CVE-2026-96833: Deserialization of Untrusted Data
Editor PHP Object Injection in Ultimate Addons for Contact Form 7 = 3.5.51 versions...
PT-2026-103217
Editor PHP Object Injection in Ultimate Addons for Contact Form 7 = 3.5.51 versions...
WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.51 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Ultimate Addons for Contact Form 7 versions = 3.5.51...