Medium · 6.5 CVE-2026-95586 EUVD-2026-85499GHSA-cg2g-v3j4-jc6g

WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.50 - Cross Site Scripting (XSS) vulnerability

Published Sep 23, 2026 · Updated Sep 23, 2026 · Assigned by Patchstack

Vendor: themefic Product: Ultimate Addons for Contact Form 7

Description

Contributor Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <= 3.5.50 versions.

Affected products

Vendor	Product	Affected	Fixed
Themefic	Ultimate Addons for Contact Form 7	≤ 3.5.50	—

References

https://patchstack.com/database/wordpress/plugin/ultimate-addons-for-contact-form-7/vulnerability/wordpress-ultimate-addons-for-contact-form-7-plugin-3-5-50-cross-site-scripting-xss-vulnerability?_s_id=cve vdb-entry