CVE-2026-95586
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Contributor Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <= 3.5.50 versions.
Risk Assessment
A user with the Contributor role can inject a malicious script that executes in other users' browsers, potentially leading to session theft or other attacks. The risk affects sites with multiple authors.
Recommendation
Update the Ultimate Addons for Contact Form 7 plugin to a version later than 3.5.50. Limit trust in content supplied by low-privileged users.
Other vulnerabilities in Ultimate Addons for Contact Form 7
See all- CVE-2026-96833High
PHP Object Injection vulnerability in Ultimate Addons for Contact Form 7 plugin up to version 3.5.51, exploitable by users with Editor role. May lead to execution of malicious PHP objects.
- CVE-2026-65439High
XSS vulnerability in Ultimate Addons for Contact Form 7 up to version 3.5.45. An unauthenticated attacker can inject malicious JavaScript.
Original NVD description (English source)
Contributor Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <= 3.5.50 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS