Advisories · Technology
themefic Ultra Addons for Contact Form 7.
Every CVE that names themefic Ultra Addons for Contact Form 7 among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.8 CriticalCritical · CVSS 9+
Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field
- themefic Ultra Addons for Contact Form 7
- Insecure deserialization
- CVSS 7.2 High
Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Stored Cross-Site Scripting via File Upload
- themefic Ultra Addons for Contact Form 7
- Cross-site scripting (XSS)
- CVSS 9.8 CriticalCritical · CVSS 9+
Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field
- themefic Ultra Addons for Contact Form 7
- Unrestricted file upload
- CVSS 6.4 Medium
Ultra Addons for Contact Form 7 <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Attributes
- themefic Ultra Addons for Contact Form 7
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
Ultra Addons for Contact Form 7 <= 3.5.33 - Missing Authorization to Authenticated (Subscriber+) to Generate Form Submission PDF
- themefic Ultra Addons for Contact Form 7
- Broken access control
- CVSS 6.4 Medium
Ultra Addons for Contact Form 7 <= 3.5.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via UACF7_CUSTOM_FIELDS Shortcode
- themefic Ultra Addons for Contact Form 7
- Cross-site scripting (XSS)
- CVSS 7.2 High
Ultra Addons for Contact Form 7 3.5.11 - 3.5.19 - Unauthenticated Stored Cross-Site Scripting via Database module
- themefic Ultra Addons for Contact Form 7
- Cross-site scripting (XSS)
- CVSS 7.2 High
Ultimate Addons for Contact Form 7 <= 3.5.12 - Authenticated (Administrator+) Arbitrary File Upload via 'save_options'
- themefic Ultra Addons for Contact Form 7
- Unrestricted file upload