CVE-2026-103999
Received Received - Intake

Stored XSS in Ultra Addons for Contact Form 7 WordPress Plugin

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Wordfence

Description
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The extension blocklist gatekeeper is bypassed by uploading text-type files (.txt, .csv, .vtt, .srt, .asc) whose contents begin with an HTML payload such as '<BODY onload=…>', as the check classifies these files as text/plain without inspecting their byte content.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-103999
EUVD
EUVD-2026-102660

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
themefic Ultra Addons for Contact Form 7 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the Ultra Addons for Contact Form 7 WordPress plugin. It allows unauthenticated attackers to inject malicious scripts into web pages by uploading specially crafted text files like .txt or .csv. These files bypass security checks because they appear as plain text but contain HTML payloads that execute when the page loads.

Detection Guidance

Check WordPress installations for the 'Ultimate Addons for Contact Form 7' plugin version 3.5.54 or lower. Inspect uploaded files with extensions .txt, .csv, .vtt, .srt, or .asc for HTML payloads like <BODY onload=...>. Review server logs for unusual file uploads or script executions.

Impact Analysis

An attacker could steal cookies, session tokens, or other sensitive data from users visiting the infected page. They might also perform actions on behalf of users, such as changing account settings or redirecting to malicious sites. The impact depends on user privileges and the plugin's usage.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles or HIPAA's security requirements. Organizations using the plugin may face compliance breaches, legal penalties, or reputational damage if user data is compromised.

Mitigation Strategies

Update the 'Ultimate Addons for Contact Form 7' plugin to the latest version. Disable file uploads if not required. Implement strict file upload validation to block text files containing HTML payloads. Monitor for suspicious activity in uploaded files and server logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103999. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart