CPE
An unauthenticated stored XSS vulnerability in Ultra Addons for Contact Form 7 (<= 3.5.54) allows attackers to bypass file extension filters and execute arbitrary JavaScript.