CVE-2026-103999

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...

EUVD-2026-102660

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...

CVE-2026-103999

The Ultra Addons for Contact Form 7 WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.5.54 . The root cause is insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts. Attackers...

CVE-2026-103999 Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Stored Cross-Site Scripting via File Upload

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...

CVE-2026-103999: Improper Neutralization of Input During Web Page Generation

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...

PT-2026-115445

Name of the Vulnerable Software and Affected Versions Ultra Addons for Contact Form 7 versions prior to 3.5.55 Description Stored Cross-Site Scripting XSS occurs due to insufficient input sanitization and output escaping during file uploads. Unauthenticated attackers can inject arbitrary web...

WordPress Ultra Addons for Contact Form 7 plugin <= 3.5.54 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin Ultimate Addons for Contact Form 7 versions = 3.5.54...

CVE-2025-12828

The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Type Out widget in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

CVE-2025-12828 Ultra Addons Lite for Elementor <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Type Out Widget

The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Type Out widget in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

EUVD-2025-211026

The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Type Out widget in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

CVE-2025-12828 Ultra Addons Lite for Elementor <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Type Out Widget

The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Type Out widget in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

CVE-2025-12828

The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.3.2 . The root cause is insufficient input sanitization and output escaping on user-supplied attributes within the Type Out widget . This allows authen...

CVE-2025-12828: Improper Neutralization of Input During Web Page Generation

The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Type Out widget in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

PT-2026-104495

Name of the Vulnerable Software and Affected Versions Ultra Addons Lite for Elementor versions prior to 1.3.3 Description Stored Cross-Site Scripting occurs via the Type Out widget due to insufficient input sanitization and output escaping on user supplied attributes. Authenticated attackers with...

WordPress Ultra Addons Lite for Elementor plugin <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Abu Hurayra HurayraIIT in WordPress Plugin Ultra Addons Lite for Elementor versions = 1.3.2...

Exploit for CVE-2026-82901

CVE-2026-82901 — Ultra Addons for Contact Form 7 Mass Exploite...

Exploit for CVE-2026-82901

CVE-2026-82901 — Ultra Addons for Contact Form 7 File Upload...

CVE-2026-82901

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7wpcf7mailcomponents' function in all versions up to, and including, 3.5.50. This makes it possible for unauthenticated attackers to upload arbitrar...

EUVD-2026-87790

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7wpcf7mailcomponents' function in all versions up to, and including, 3.5.50. This makes it possible for unauthenticated attackers to upload arbitrar...

CVE-2026-82901

The Ultra Addons for Contact Form 7 WordPress plugin (versions ≤ 3.5.50 ) is vulnerable to unauthenticated arbitrary file upload (CWE-434) due to insufficient validation in the uacf7_wpcf7_mail_components function. This flaw is specifically exploitable when the PDF Generator module is enabled (wh...