CVE-2026-65439
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
XSS vulnerability in Ultimate Addons for Contact Form 7 up to version 3.5.45. An unauthenticated attacker can inject malicious JavaScript.
Risk Assessment
Risk includes session theft, redirection to malicious sites, or theft of sensitive data.
Recommendation
Update the Ultimate Addons for Contact Form 7 plugin to the latest version.
Other vulnerabilities in Ultimate Addons for Contact Form 7
See all- CVE-2026-96833High
PHP Object Injection vulnerability in Ultimate Addons for Contact Form 7 plugin up to version 3.5.51, exploitable by users with Editor role. May lead to execution of malicious PHP objects.
- CVE-2026-95586Medium
Contributor Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <= 3.5.50 versions.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <=3.5.45 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS