SecAlerts
u

ultra addons

Security Risk Profile

50
/100
medium

Security Risk Score

Comprehensive risk assessment based on 10 vulnerabilities, EPSS scores, exploitation status, and remediation availability.

📅 Data spans from February 28, 2025 to present

10
Total CVEs
4
Critical+High
0
Exploited
4
Unpatched

Threat Assessment

Avg CVSS
6.8
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
4
Critical/High
Risk Level
50/100
medium
🆕 1Fresh (<7d)📈 3 in Last 30 Days

Severity Distribution

Critical
1
High
3
Medium
6
Low
0

Exploit Likelihood

>50% chance
0
20-50%
0
5-20%
0
<5%
4

Age Distribution

Common Weaknesses (CWE)

1
XSS
6
2
Malicious File Upload
2

Most Affected Products

1. Ultra Addons Ultra Addons for Contact Form 73
2. Ultra Addons Contact Form 73
3. Themefic Ultimate Addons For Contact Form 7 Wordpress3
4. Ultra Addons Ultra Addons Lite for Elementor2
5. Ultra Addons Ultra Addons for WPForms1

Recent Vulnerabilities

See more →
CVE-2026-103999
CVSS 7.2high

Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Stored Cross-Site Scripting via File Upload

Oct 16, 2026🔧 No Patch
CVE-2025-12828
CVSS 6.4medium

Ultra Addons Lite for Elementor <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Type Out Widget

Oct 3, 2026🔧 No Patch
CVE-2026-82901
CVSS 9.8critical

Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field

Sep 26, 2026🔧 No Patch
CVE-2026-12801
CVSS 6.4medium

Ultra Addons for Contact Form 7 <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Attributes

Aug 7, 2026🔧 No Patch
CVE-2026-39594
CVSS 6.4medium

WordPress Ultra Addons for WPForms plugin <= 1.0.11 - Broken Access Control vulnerability

Jun 15, 2026🔧 No Patch
CVE-2025-9077
CVSS 6.4EPSS 0%medium

Ultra Addons Lite for Elementor <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text Field

Oct 3, 2025🔧 No Patch
CVE-2025-6756
CVSS 6.4EPSS 0%medium

Ultra Addons for Contact Form 7 <= 3.5.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via UACF7_CUSTOM_FIELDS Shortcode

Jul 1, 2025🔧 No Patch
CVE-2025-6212
CVSS 7.2EPSS 0%high

Ultra Addons for Contact Form 7 3.5.11 - 3.5.19 - Unauthenticated Stored Cross-Site Scripting via Database module

Jun 26, 2025🔧 No Patch
CVE-2025-6220
CVSS 7.2EPSS 0%high

Ultimate Addons for Contact Form 7 <= 3.5.12 - Authenticated (Administrator+) Arbitrary File Upload via 'save_options'

Jun 18, 2025🔧 No Patch
CVE-2024-13832
CVSS 4.3medium

Ultra Addons Lite for Elementor <= 1.1.8 - Authenticated (Contributor+) Restricted Post Disclosure

Feb 28, 2025🔧 No Patch

Monitor ultra addons in Real-Time

Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.

Powered bySecAlerts

Monitor Your Software Stack in Real-Time

Get instant alerts when vulnerabilities are discovered in your software stack. Stay ahead of security threats with SecAlerts.

© 2026 SecAlerts Pty Ltd. All rights reserved.

ultra addons Security Vulnerabilities & Risk Score | 10 CVEs | SecAlerts - SecAlerts