PLUGIN SECURITY
Is Ultra Addons for Contact Form 7 safe?
Known vulnerabilities, PHP compatibility and safer alternatives for the Ultra Addons for Contact Form 7 WordPress plugin — checked against WP Clinic's local security database.
What this plugin does
- Slug:
ultimate-addons-for-contact-form-7
Maintenance status
Known vulnerabilities
20 known CVEs on file for Ultra Addons for Contact Form 7.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-100386 | Ultra Addons for Contact Form 7 [ultimate-addons-for-contact-form-7] < 3.5.55 | Improper Limitation of a Pathname to a Restricted Directory | High 7.5 | < 3.5.55 | 3.5.55 | 2026-11-02 | — |
| CVE-2026-102435 | Ultra Addons for Contact Form 7 [ultimate-addons-for-contact-form-7] < 3.5.55 | Deserialization of Untrusted Data | Critical 9.8 | < 3.5.55 | 3.5.55 | 2026-10-15 | — |
| CVE-2026-96833 | Ultra Addons for Contact Form 7 [ultimate-addons-for-contact-form-7] < 3.5.52 | Deserialization of Untrusted Data | High 7.2 | < 3.5.52 | 3.5.52 | 2026-09-26 | — |
| CVE-2026-103999 | Ultra Addons for Contact Form 7 [ultimate-addons-for-contact-form-7] < 3.5.55 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.2 | < 3.5.55 | 3.5.55 | 2026-09-26 | — |
| CVE-2026-82901 | Ultra Addons for Contact Form 7 [ultimate-addons-for-contact-form-7] < 3.5.51 | Unrestricted Upload of File with Dangerous Type | Critical 9.8 | < 3.5.51 | 3.5.51 | 2026-09-22 | — |
| CVE-2026-95586 | Ultra Addons for Contact Form 7 [ultimate-addons-for-contact-form-7] < 3.5.51 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.5 | < 3.5.51 | 3.5.51 | 2026-09-17 | — |
| CVE-2026-12801 | Ultra Addons for Contact Form 7 [ultimate-addons-for-contact-form-7] < 3.5.44 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 3.5.44 | 3.5.44 | 2026-08-06 | — |
| CVE-2026-84750 | Ultra Addons for Contact Form 7 [ultimate-addons-for-contact-form-7] >= 3.2.4 - < 3.5.51 | Unrestricted Upload of File with Dangerous Type | Unknown | 3.2.4–3.5.51 | 3.5.51 | 2026-08-06 | — |
+ 15 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-65439 | Ultra Addons for Contact Form 7 [ultimate-addons-for-contact-form-7] < 3.5.46 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 3.5.46 | 3.5.46 | 2026-03-14 | — |
| CVE-2026-32460 | Ultra Addons for Contact Form 7 [ultimate-addons-for-contact-form-7] < 3.5.37 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.5 | < 3.5.37 | 3.5.37 | 2026-03-13 | — |
| CVE-2026-24945 | Ultra Addons for Contact Form 7 [ultimate-addons-for-contact-form-7] < 3.5.35 | Missing Authorization | Medium 5.3 | < 3.5.35 | 3.5.35 | 2025-12-13 | — |
| CVE-2025-14356 | Ultra Addons for Contact Form 7 [ultimate-addons-for-contact-form-7] < 3.5.34 | Authorization Bypass Through User-Controlled Key | Medium 4.3 | < 3.5.34 | 3.5.34 | 2025-12-11 | — |
| CVE-2023-49766 | Ultra Addons for Contact Form 7 [ultimate-addons-for-contact-form-7] < 3.2.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 3.2.1 | 3.2.1 | 2023-12-04 | — |
| CVE-2023-47693 | Ultra Addons for Contact Form 7 [ultimate-addons-for-contact-form-7] < 3.2.11 | Missing Authorization | High 7.5 | < 3.2.11 | 3.2.11 | 2023-11-09 | — |
| CVE-2023-30493 | Ultra Addons for Contact Form 7 [ultimate-addons-for-contact-form-7] < 3.2.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 3.2.1 | 3.2.1 | 2023-08-28 | — |
| CVE-2023-2802 | Ultra Addons for Contact Form 7 [ultimate-addons-for-contact-form-7] < 3.1.29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 3.1.29 | 3.1.29 | 2023-07-24 | — |
| CVE-2023-2803 | Ultra Addons for Contact Form 7 [ultimate-addons-for-contact-form-7] < 3.1.29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 3.1.29 | 3.1.29 | 2023-07-24 | — |
| CVE-2023-1615 | Ultra Addons for Contact Form 7 [ultimate-addons-for-contact-form-7] < 3.1.24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Medium 6.5 | < 3.1.24 | 3.1.24 | 2023-06-08 | — |
| CVE-2022-47586 | Ultra Addons for Contact Form 7 [ultimate-addons-for-contact-form-7] < 3.1.24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 8.2 | < 3.1.24 | 3.1.24 | 2023-05-09 | — |
| CVE-2023-30495 | Ultra Addons for Contact Form 7 [ultimate-addons-for-contact-form-7] < 3.1.24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 8.5 | < 3.1.24 | 3.1.24 | 2023-04-24 | — |
| — | Ultra Addons for Contact Form 7 [ultimate-addons-for-contact-form-7] < 3.5.13 | Unrestricted Upload of File with Dangerous Type | High 7.2 | < 3.5.13 | 3.5.13 | 0000-00-00 | — |
| — | Ultra Addons for Contact Form 7 [ultimate-addons-for-contact-form-7] < 3.5.20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 3.5.20 | 3.5.20 | 0000-00-00 | — |
| — | Ultra Addons for Contact Form 7 [ultimate-addons-for-contact-form-7] < 3.5.22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.5.22 | 3.5.22 | 0000-00-00 | — |
How to fix it
Update this plugin to the latest release from wordpress.org — each CVE above lists the exact release that fixed it ("Fixed in") when one is on file.
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.