Stored XSS via File Upload in Ultra Addons for Contact Form 7

The Ultra Addons for Contact Form 7 plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability, tracked as CVE-2026-103999. The flaw exists due to insufficient input sanitization and output escaping during the file upload process in versions 3.5.54 and earlier. An unauthenticated attacker can circumvent the plugin's file extension blocklist by uploading text-based files, such as .txt, .csv, .vtt, .srt, or .asc, that contain embedded malicious HTML or JavaScript payloads. Because the plugin logic only validates the file extension and classifies the content as text/plain without inspecting the actual byte-level content or sanitizing the output, the injected scripts execute within the browser context of any user who accesses the compromised page. This vulnerability poses a significant risk for session hijacking, unauthorized actions on behalf of site administrators, or the redirection of site visitors to malicious content.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary web scripts in the context of the WordPress site. This can lead to the theft of session cookies, modification of site content, or the execution of unauthorized administrative actions, affecting any user who views an injected page.

Recommendation

• Update the Ultra Addons for Contact Form 7 plugin to a version released after 3.5.54 immediately to remediate CVE-2026-103999.
• Implement strict Content Security Policy (CSP) headers to mitigate the impact of XSS by restricting the execution of inline scripts and unauthorized external domains.
• Enable server-side MIME type verification for all user-uploaded files to ensure that the actual file content matches the expected file type, rather than relying solely on file extensions.