# Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Stored Cross-Site Scripting via Form File Uploads

- **ID:** WPSEC-2026-0775
- **Plugin:** Ultra Addons for Contact Form 7 (`ultimate-addons-for-contact-form-7`), https://wordpress.org/plugins/ultimate-addons-for-contact-form-7/
- **Affected versions:** all versions before 3.5.55
- **Fixed in:** 3.5.55 (Update to 3.5.55 or later.)
- **Severity:** High 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-11)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/ultimate-addons-for-contact-form-7
- **Fix released:** 2026-10-10
- **Published:** 2026-10-11
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0775/

## Description

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form file uploads in all versions up to, and including, 3.5.54. This is due to insufficient content validation of text-type uploads and the database addon copying uploaded files into the publicly accessible uacf7-uploads directory without a file extension and without any protection against MIME sniffing. This makes it possible for unauthenticated attackers to upload files containing HTML or script that execute in the browser of a user who accesses the stored file, such as an administrator reviewing submissions.

## References

- https://wpsec.com/vuln/WPSEC-2026-0775/
- https://plugins.svn.wordpress.org/ultimate-addons-for-contact-form-7/tags/3.5.55/
- https://wordpress.org/plugins/ultimate-addons-for-contact-form-7/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0775/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.