What’s Vulnerable › Products
Themefic Ultimate Addons for Contact Form 7 vulnerabilities
20 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 13 published in the last 12 months.
Check whether your Themefic Ultimate Addons for Contact Form 7 version is affected
Latest Themefic Ultimate Addons for Contact Form 7 vulnerabilities
- CVE-2026-103999 — Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Stored Cross-Site Scripting via File Upload (CVSS 7.2)
- CVE-2026-96833 — WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.51 - PHP Object Injection vulnerability (CVSS 7.2)
- CVE-2026-82901 — Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field (CVSS 9.8)
- CVE-2026-95586 — WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.50 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- CVE-2026-12801 — Ultra Addons for Contact Form 7 <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Attributes (CVSS 6.4)
- CVE-2026-65439 — WordPress Ultimate Addons for Contact Form 7 plugin <=3.5.45 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- CVE-2026-32460 — WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.36 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- CVE-2026-24945 — WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.34 - Broken Access Control vulnerability (CVSS 5.3)
- CVE-2025-14356 — Ultra Addons for Contact Form 7 <= 3.5.33 - Missing Authorization to Authenticated (Subscriber+) to Generate Form Submission PDF (CVSS 4.3)
- CVE-2025-6756 — Ultra Addons for Contact Form 7 <= 3.5.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via UACF7_CUSTOM_FIELDS Shortcode (CVSS 5.4)
- CVE-2025-6212 — Ultra Addons for Contact Form 7 3.5.11 - 3.5.19 - Unauthenticated Stored Cross-Site Scripting via Database module (CVSS 6.1)
- CVE-2025-6220 — Ultimate Addons for Contact Form 7 <= 3.5.12 - Authenticated (Administrator+) Arbitrary File Upload via 'save_options' (CVSS 7.2)
- CVE-2023-47693 — WordPress Ultimate Addons for Contact Form 7 plugin <= 3.2.6 - Broken Access Control vulnerability (CVSS 7.5)
- CVE-2023-30495 — WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.1.23 is vulnerable to SQL Injection (CVSS 8.1)
- CVE-2023-49766 — WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.2.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.1)
- CVE-2023-30493 — WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.2.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.1)
- CVE-2023-2803 — Ultimate Addons for Contact Form 7 < 3.1.29 - Reflected XSS (CVSS 6.1)
- CVE-2023-2802 — Ultimate Addons for Contact Form 7 < 3.1.29 - Admin+ Stored XSS (CVSS 4.8)
- CVE-2022-47586 — WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.1.23 is vulnerable to SQL Injection (CVSS 9.8)
- CVE-2023-1615 — (CVSS 6.5)