Live › vulnerability › CVE-2026-103999
Go to dashboardThe Ultra Addons for Contact Form 7 plugin for WordPress, in all versions up to and including 3.5.54, accepts text files such as .txt, .csv or .vtt whose contents are HTML. An unauthenticated attacker can upload such a file so that its script runs in the browser of anyone who opens the injected page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Ultra Addons for Contact Form 7 plugin at version 3.5.54 or older that expose a contact form with a file upload field to the public. Sites without this plugin, or without a public upload field, are not exposed by this flaw.
No product ranges from the sources yet.
wp plugin get ultra-addons-contact-form-7 --field=version (the plugin slug is unknown from the sources; confirm it).3.5.54; the patched version number is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The extension blocklist gatekeeper is bypassed by uploading text-type files (.txt, .csv, .vtt, .srt, .asc) whose contents begin with an HTML payload such as '<BODY onload=…>', as the check classifies these files as text/plain without inspecting their byte content.
This page as .md · .json · in your agent: get_signal("CVE-2026-103999")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.