Ultra Addons for Contact Form 7

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Ultra Addons for Contact Form 7

Information

Software Type Plugin
Software Slug ultimate-addons-for-contact-form-7 (view on wordpress.org)
Software Status Active
Software Author themefic
Software Website cf7addons.com
Software Downloads 2,477,228
Software Active Installs 60,000
Software Record Last Updated October 14, 2026

20 Vulnerabilities

Submit a Vulnerability
Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field
9.8
CVE-2026-82901
Sep 26, 2026
Researcher: Supakiad S. (m3ez)
Ultra Addons for Contact Form 7 <= 3.5.51 - Authenticated (Editor+) PHP Object Injection
6.6
CVE-2026-96833
Sep 24, 2026
Researcher: Ananda Dhakal
Ultra Addons for Contact Form 7 <= 3.5.50 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-95586
Sep 22, 2026
Researcher: Marc-André Beaulieu
Ultimate Addons for Contact Form 7 3.2.4 - 3.5.50 - Unauthenticated Arbitrary File Upload
9.8
CVE-2026-84750
Sep 17, 2026
Researcher: Jakub Herman
Ultra Addons for Contact Form 7 <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Attributes
6.4
CVE-2026-12801
Aug 6, 2026
Researcher: Webbernaut
Ultimate Addons for Contact Form 7 <= 3.5.45 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-65439
Jul 27, 2026
Researcher: Nguyen Ba Khanh
Ultra Addons for Contact Form 7 <= 3.5.36 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-32460
Mar 14, 2026
Researcher: Marc-André Beaulieu (h3dg3h0g)
Ultimate Addons for Contact Form 7 <= 3.5.34 - Missing Authorization
5.3
CVE-2026-24945
Dec 13, 2025
Researcher: Legion Hunter
Ultra Addons for Contact Form 7 <= 3.5.33 - Missing Authorization to Authenticated (Subscriber+) to Generate Form Submission PDF
4.3
CVE-2025-14356
Dec 11, 2025
Researcher: shark3y
Ultra Addons for Contact Form 7 <= 3.5.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via UACF7_CUSTOM_FIELDS Shortcode
6.4
CVE-2025-6756
Jun 30, 2025
Researcher: Muhammad Yudha - DJ
Ultra Addons for Contact Form 7 3.5.11 - 3.5.19 - Unauthenticated Stored Cross-Site Scripting via Database module
7.2
CVE-2025-6212
Jun 25, 2025
Researcher: Sy5temFr4cture
Ultimate Addons for Contact Form 7 <= 3.5.12 - Authenticated (Administrator+) Arbitrary File Upload via 'save_options'
7.2
CVE-2025-6220
Jun 17, 2025
Researcher: Ryan Kozak
Ultimate Addons for Contact Form 7 <= 3.2.0 - Reflected Cross-Site Scripting
6.1
CVE-2023-49766
Dec 4, 2023
Researcher: R3N0
Ultimate Addons for Contact Form 7 <= 3.2.10 - Missing Authorization
5.3
CVE-2023-47693
Nov 9, 2023
Researcher: minhtuanact
Ultimate Addons for Contact Form 7 <= 3.1.0 - Reflected Cross-Site Scripting via 'page'
6.1
CVE-2023-30493
Aug 28, 2023
Researcher: LEE SE HYOUNG
Ultimate Addons for Contact Form 7 <= 3.1.28 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2023-2802
Jul 24, 2023
Researcher: Alex Sanford
Ultimate Addons for Contact Form 7 <= 3.1.28 - Reflected Cross-Site Scripting
6.1
CVE-2023-2803
Jul 24, 2023
Researcher: Hung Duong (henry1601)
Ultimate Addons for Contact Form 7 <= 3.1.23 - Authenticated(Subscriber+) SQL Injection
8.8
CVE-2023-1615
Jun 8, 2023
Researcher: Etan Imanol Castro Aldrete
Ultimate Addons for Contact Form 7 <= 3.1.23 - Unauthenticated SQL Injection via form_id
9.8
CVE-2022-47586
May 9, 2023
Researcher: minhtuanact
Ultimate Addons for Contact Form 7 <= 3.1.23 - Authenticated (Subscriber+) SQL Injection via id
8.8
CVE-2023-30495
Apr 24, 2023
Researcher: Ivy (TOOR, Lisa)
Title Status CVE ID CVSS Researchers Date
Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field Patched CVE-2026-82901 9.8 Supakiad S. (m3ez) September 26, 2026
Ultra Addons for Contact Form 7 <= 3.5.51 - Authenticated (Editor+) PHP Object Injection Patched CVE-2026-96833 6.6 Ananda Dhakal September 24, 2026
Ultra Addons for Contact Form 7 <= 3.5.50 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2026-95586 6.4 Marc-André Beaulieu September 22, 2026
Ultimate Addons for Contact Form 7 3.2.4 - 3.5.50 - Unauthenticated Arbitrary File Upload Patched CVE-2026-84750 9.8 Jakub Herman September 17, 2026
Ultra Addons for Contact Form 7 <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Attributes Patched CVE-2026-12801 6.4 Webbernaut August 6, 2026
Ultimate Addons for Contact Form 7 <= 3.5.45 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2026-65439 7.2 Nguyen Ba Khanh July 27, 2026
Ultra Addons for Contact Form 7 <= 3.5.36 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2026-32460 6.4 Marc-André Beaulieu (h3dg3h0g) March 14, 2026
Ultimate Addons for Contact Form 7 <= 3.5.34 - Missing Authorization Patched CVE-2026-24945 5.3 Legion Hunter December 13, 2025
Ultra Addons for Contact Form 7 <= 3.5.33 - Missing Authorization to Authenticated (Subscriber+) to Generate Form Submission PDF Patched CVE-2025-14356 4.3 shark3y December 11, 2025
Ultra Addons for Contact Form 7 <= 3.5.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via UACF7_CUSTOM_FIELDS Shortcode Patched CVE-2025-6756 6.4 Muhammad Yudha - DJ June 30, 2025
Ultra Addons for Contact Form 7 3.5.11 - 3.5.19 - Unauthenticated Stored Cross-Site Scripting via Database module Patched CVE-2025-6212 7.2 Sy5temFr4cture June 25, 2025
Ultimate Addons for Contact Form 7 <= 3.5.12 - Authenticated (Administrator+) Arbitrary File Upload via 'save_options' Patched CVE-2025-6220 7.2 Ryan Kozak June 17, 2025
Ultimate Addons for Contact Form 7 <= 3.2.0 - Reflected Cross-Site Scripting Patched CVE-2023-49766 6.1 R3N0 December 4, 2023
Ultimate Addons for Contact Form 7 <= 3.2.10 - Missing Authorization Patched CVE-2023-47693 5.3 minhtuanact November 9, 2023
Ultimate Addons for Contact Form 7 <= 3.1.0 - Reflected Cross-Site Scripting via 'page' Patched CVE-2023-30493 6.1 LEE SE HYOUNG August 28, 2023
Ultimate Addons for Contact Form 7 <= 3.1.28 - Authenticated (Admin+) Stored Cross-Site Scripting Patched CVE-2023-2802 4.4 Alex Sanford July 24, 2023
Ultimate Addons for Contact Form 7 <= 3.1.28 - Reflected Cross-Site Scripting Patched CVE-2023-2803 6.1 Hung Duong (henry1601) July 24, 2023
Ultimate Addons for Contact Form 7 <= 3.1.23 - Authenticated(Subscriber+) SQL Injection Patched CVE-2023-1615 8.8 Etan Imanol Castro Aldrete June 8, 2023
Ultimate Addons for Contact Form 7 <= 3.1.23 - Unauthenticated SQL Injection via form_id Patched CVE-2022-47586 9.8 minhtuanact May 9, 2023
Ultimate Addons for Contact Form 7 <= 3.1.23 - Authenticated (Subscriber+) SQL Injection via id Patched CVE-2023-30495 8.8 Ivy (TOOR, Lisa) April 24, 2023

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation