CVE-2026-95586: WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.50 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <= 3.5.50 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Ultimate Addons for Contact Form 7to a version that resolves this vulnerability.Fixed in 3.5.51
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerability is described as contributor XSS, so exploitation requires contributor-level access to a WordPress site running an affected version of the plugin. The provided vector also indicates low privileges are required and user interaction is required.
Which plugin versions are affected?
Ultimate Addons for Contact Form 7 versions 3.5.50 and earlier are identified as affected.
What impact can successful exploitation have?
The supplied CVSS vector indicates low confidentiality, integrity, and availability impact, with scope changed. This means the issue can affect resources beyond the vulnerable plugin's security authority.