{"id":"CVE-2026-103999","kind":"vulnerability","aliases":["CVE-2026-103999"],"related":[],"title":"WordPress Ultra Addons for Contact Form 7: file upload enables stored cross-site scripting","description":"The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The extension blocklist gatekeeper is bypassed by uploading text-type files (.txt, .csv, .vtt, .srt, .asc) whose contents begin with an HTML payload such as '<BODY onload=…>', as the check classifies these files as text/plain without inspecting their byte content.","summary":"The Ultra Addons for Contact Form 7 plugin for WordPress, in all versions up to and including 3.5.54, accepts text files such as .txt, .csv or .vtt whose contents are HTML. An unauthenticated attacker can upload such a file so that its script runs in the browser of anyone who opens the injected page.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugins"],"not_affected_if":["no-public-file-upload","plugin-patched"],"how_to_check":"- Check the installed version of the Ultra Addons for Contact Form 7 plugin in the WordPress admin under Plugins, or with `wp plugin get ultra-addons-contact-form-7 --field=version` (the plugin slug is unknown from the sources; confirm it).\n- Check whether the plugin's file upload field is enabled on any public form.","fix":"- Update the Ultra Addons for Contact Form 7 plugin to a version later than `3.5.54`; the patched version number is unknown from the sources.\n- Until patched, disable the file upload field on public forms or restrict uploads to image types.","status":"open","published_at":"2026-10-16T06:17:03+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:29:53+00:00","updated_at":"2026-10-25T03:29:53+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:29:53Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Ultra Addons for Contact Form 7 plugin to a version later than `3.5.54`; the patched version number is unknown from the sources.\n- Until patched, disable the file upload field on public forms or restrict uploads to image types.","reach":"internet","title":"WordPress Ultra Addons for Contact Form 7: file upload enables stored cross-site scripting","impact":"medium","summary":"The Ultra Addons for Contact Form 7 plugin for WordPress, in all versions up to and including 3.5.54, accepts text files such as .txt, .csv or .vtt whose contents are HTML. An unauthenticated attacker can upload such a file so that its script runs in the browser of anyone who opens the injected page.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugins","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker script runs in visitors' browsers, stealing admin sessions or defacing pages.","analyst_note":"Confirm the patched plugin version and the plugin slug from the NVD or Wordfence entry; the sources give no fixed version.","how_to_check":"- Check the installed version of the Ultra Addons for Contact Form 7 plugin in the WordPress admin under Plugins, or with `wp plugin get ultra-addons-contact-form-7 --field=version` (the plugin slug is unknown from the sources; confirm it).\n- Check whether the plugin's file upload field is enabled on any public form.","needs_analyst":true,"not_affected_if":["no-public-file-upload","plugin-patched"],"who_is_affected":"Sites running the Ultra Addons for Contact Form 7 plugin at version 3.5.54 or older that expose a contact form with a file upload field to the public. Sites without this plugin, or without a public upload field, are not exposed by this flaw.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000688,"input_tokens":3456,"output_tokens":684,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-103999':18A,21A '-2026':17A,20A '3.5.54':47B,112C '7':7A,36B,90C 'accept':48B 'access':141C 'addon':3A,32B,86C 'anyon':78B 'arbitrari':130C 'asc':161C 'attack':63B,127C 'begin':164C 'blocklist':147C 'bodi':171C 'browser':76B 'bypass':150C 'byte':184C 'check':175C 'classifi':176C 'contact':5A,34B,88C 'content':58B,163C,185C 'cross':13A,99C 'cross-sit':12A,98C 'csv':54B,158C 'cve':16A,19A 'due':113C 'enabl':10A 'escap':120C 'execut':137C 'extens':146C 'file':8A,50B,68B,103C,156C,178C 'form':6A,35B,89C 'gatekeep':148C 'host':25B 'html':60B,167C 'includ':46B,111C 'inject':82B,129C,143C 'input':116C 'inspect':182C 'insuffici':115C 'make':122C 'onload':172C 'open':80B 'output':119C 'packag':22B 'page':83B,134C,144C 'payload':168C 'plugin':29B,37B,91C 'possibl':124C 'run':73B 'sanit':117C 'script':15A,72B,101C,132C 'self':24B 'self-host':23B 'site':14A,100C 'srt':160C 'store':11A,97C 'text':49B,154C 'text-typ':153C 'text/plain':180C 'txt':53B,157C 'type':155C 'ultra':2A,31B,85C 'unauthent':62B,126C 'upload':9A,65B,104C,152C 'user':140C 'version':42B,107C 'via':102C 'vtt':56B,159C 'vulner':95C 'web':131C 'whenev':138C 'whose':57B,162C 'without':181C 'wordpress':1A,26B,28B,39B,93C 'wordpress-plugin':27B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Ultra Addons for Contact Form 7 plugin at version 3.5.54 or older that expose a contact form with a file upload field to the public. Sites without this plugin, or without a public upload field, are not exposed by this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T06:17:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103999","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103999","severity":null,"published_at":"2026-10-16T06:17:03+00:00","modified_at":"2026-10-16T15:17:02+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}