Skip to content
Noroxi

Ultimate Addons for Contact Form 7

ultimate-addons-for-contact-form-7 · plugin

Known security vulnerabilities for Ultimate Addons for Contact Form 7. Find out in seconds which version runs on your site with WP Lens.

17 known vulnerabilities

2 critical · 2 with public exploit code · latest Sep 30, 2026

Vulnerabilities

  • CVE-2026-82901

    Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field

    Critical 9.8

  • CVE-2022-47586

    WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.1.23 is vulnerable to SQL Injection

    Critical 9.8

  • CVE-2023-30495

    WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.1.23 is vulnerable to SQL Injection

    High 8.1

  • CVE-2023-47693

    WordPress Ultimate Addons for Contact Form 7 plugin <= 3.2.6 - Broken Access Control vulnerability

    High 7.5

  • CVE-2026-96833

    WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.51 - PHP Object Injection vulnerability

    High 7.2

  • CVE-2025-6220

    Ultimate Addons for Contact Form 7 <= 3.5.12 - Authenticated (Administrator+) Arbitrary File Upload via 'save_options'

    High 7.2

  • CVE-2026-65439

    WordPress Ultimate Addons for Contact Form 7 plugin <=3.5.45 - Cross Site Scripting (XSS) vulnerability

    High 7.1

  • CVE-2026-95586

    WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.50 - Cross Site Scripting (XSS) vulnerability

    Medium 6.5

  • CVE-2026-32460

    WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.36 - Cross Site Scripting (XSS) vulnerability

    Medium 6.5

  • CVE-2023-1615

    The Ultimate Addons for Contact Form 7 plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in versions up to, and inc

    Medium 6.5

  • CVE-2026-12801

    Ultra Addons for Contact Form 7 <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Attributes

    Medium 6.4

  • CVE-2025-6212

    Ultra Addons for Contact Form 7 3.5.11 - 3.5.19 - Unauthenticated Stored Cross-Site Scripting via Database module

    Medium 6.1

  • CVE-2023-49766

    WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.2.0 is vulnerable to Cross Site Scripting (XSS)

    Medium 6.1

  • CVE-2023-30493

    WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.2.0 is vulnerable to Cross Site Scripting (XSS)

    Medium 6.1

  • CVE-2025-6756

    Ultra Addons for Contact Form 7 <= 3.5.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via UACF7_CUSTOM_FIELDS Shortcode

    Medium 5.4

  • CVE-2026-24945

    WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.34 - Broken Access Control vulnerability

    Medium 5.3

  • CVE-2025-14356

    Ultra Addons for Contact Form 7 <= 3.5.33 - Missing Authorization to Authenticated (Subscriber+) to Generate Form Submission PDF

    Medium 4.3

← Back to directory