Vendor
high
advisory
Ultra Addons for Contact Form 7: Directory Traversal (CVE-2026-100386)
2 TTPs 1 CVEThe Ultra Addons for Contact Form 7 WordPress plugin is vulnerable to directory traversal via the uacf7_wpcf7_mail_components function, allowing unauthenticated file disclosure when specific PDF generation features are enabled.
Ultra Addons for Contact Form 7
web-application
wordpress
vulnerability
directory-traversal
2t
1c
high
advisory
Stored XSS via File Upload in Ultra Addons for Contact Form 7
2 TTPs 1 CVEAn unauthenticated stored XSS vulnerability in Ultra Addons for Contact Form 7 (<= 3.5.54) allows attackers to bypass file extension filters and execute arbitrary JavaScript.
Ultra Addons for Contact Form 7
2t
1c
critical
advisory
Arbitrary File Upload Vulnerability in Ultra Addons for Contact Form 7
2 TTPs 1 CVEAn arbitrary file upload vulnerability in the Ultra Addons for Contact Form 7 plugin, tracked as CVE-2026-82901, allows unauthenticated attackers to execute arbitrary code when the PDF Generator module is enabled.
PoC
Ultra Addons for Contact Form 7
2t
1c
updated