Ultimate Addons for Contact Form 7 vulnerabilities

3 known CVE vulnerabilities in Ultimate Addons for Contact Form 7, translated and rated.

CVE-2026-96833High
PHP Object Injection vulnerability in Ultimate Addons for Contact Form 7 plugin up to version 3.5.51, exploitable by users with Editor role. May lead to execution of malicious PHP objects.
CVE-2026-95586Medium
Contributor Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <= 3.5.50 versions.
CVE-2026-65439High
XSS vulnerability in Ultimate Addons for Contact Form 7 up to version 3.5.45. An unauthenticated attacker can inject malicious JavaScript.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS