{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/ultra-addons-for-contact-form-7--3.5.54/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ultraaddons:ultra_addons_for_contact_form_7:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-103999"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Ultra Addons for Contact Form 7 (\u003c= 3.5.54)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Ultra Addons"],"content_html":"\u003cp\u003eThe Ultra Addons for Contact Form 7 plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability, tracked as CVE-2026-103999. The flaw exists due to insufficient input sanitization and output escaping during the file upload process in versions 3.5.54 and earlier. An unauthenticated attacker can circumvent the plugin's file extension blocklist by uploading text-based files, such as .txt, .csv, .vtt, .srt, or .asc, that contain embedded malicious HTML or JavaScript payloads. Because the plugin logic only validates the file extension and classifies the content as text/plain without inspecting the actual byte-level content or sanitizing the output, the injected scripts execute within the browser context of any user who accesses the compromised page. This vulnerability poses a significant risk for session hijacking, unauthorized actions on behalf of site administrators, or the redirection of site visitors to malicious content.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to execute arbitrary web scripts in the context of the WordPress site. This can lead to the theft of session cookies, modification of site content, or the execution of unauthorized administrative actions, affecting any user who views an injected page.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Ultra Addons for Contact Form 7 plugin to a version released after 3.5.54 immediately to remediate CVE-2026-103999.\u003c/li\u003e\n\u003cli\u003eImplement strict Content Security Policy (CSP) headers to mitigate the impact of XSS by restricting the execution of inline scripts and unauthorized external domains.\u003c/li\u003e\n\u003cli\u003eEnable server-side MIME type verification for all user-uploaded files to ensure that the actual file content matches the expected file type, rather than relying solely on file extensions.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T06:26:18Z","date_published":"2026-10-16T06:26:18Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-103999/","summary":"An unauthenticated stored XSS vulnerability in Ultra Addons for Contact Form 7 (\u003c= 3.5.54) allows attackers to bypass file extension filters and execute arbitrary JavaScript.","title":"Stored XSS via File Upload in Ultra Addons for Contact Form 7","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-103999/"}],"language":"en","title":"CraftedSignal Threat Feed - Ultra Addons for Contact Form 7 (\u003c= 3.5.54)","version":"https://jsonfeed.org/version/1.1"}