Description
Unauthenticated Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <=3.5.45 versions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Themefic | Ultimate Addons for Contact Form 7 | ≤ 3.5.45 | — |
High · 7.1
CVE-2026-65439
EUVD-2026-49663GHSA-49fq-v3jv-jqc3
WordPress Ultimate Addons for Contact Form 7 plugin <=3.5.45 - Cross Site Scripting (XSS) vulnerability
Published Jul 27, 2026 · Updated Jul 28, 2026 · Assigned by Patchstack