---
id: "CVE-2026-103999"
kind: "vulnerability"
aliases: ["CVE-2026-103999"]
title: "WordPress Ultra Addons for Contact Form 7: file upload enables stored cross-site scripting"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wordpress-plugins"]
not_affected_if: ["no-public-file-upload", "plugin-patched"]
published_at: "2026-10-16T06:17:03+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T03:29:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103999", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# WordPress Ultra Addons for Contact Form 7: file upload enables stored cross-site scripting

The Ultra Addons for Contact Form 7 plugin for WordPress, in all versions up to and including 3.5.54, accepts text files such as .txt, .csv or .vtt whose contents are HTML. An unauthenticated attacker can upload such a file so that its script runs in the browser of anyone who opens the injected page.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Ultra Addons for Contact Form 7 plugin in the WordPress admin under Plugins, or with `wp plugin get ultra-addons-contact-form-7 --field=version` (the plugin slug is unknown from the sources; confirm it).
- Check whether the plugin's file upload field is enabled on any public form.

## Fix

- Update the Ultra Addons for Contact Form 7 plugin to a version later than `3.5.54`; the patched version number is unknown from the sources.
- Until patched, disable the file upload field on public forms or restrict uploads to image types.

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103999

## From the sources

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The extension blocklist gatekeeper is bypassed by uploading text-type files (.txt, .csv, .vtt, .srt, .asc) whose contents begin with an HTML payload such as '<BODY onload=…>', as the check classifies these files as text/plain without inspecting their byte content.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_