Stored Cross-Site Scripting in Ultra Addons for Contact Form 7 Plugin by WordPress

CVE-2025-6212

What is CVE-2025-6212?

The Ultra Addons for Contact Form 7 plugin is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization within its Database module. This vulnerability allows unfiltered field names to be saved alongside sanitized values. When accessed, the admin-side AJAX endpoint, ajax_get_table_data(), outputs these raw names as JSON column headers. The client-side DataTables renderer directly injects these headers into the Document Object Model (DOM) without proper HTML encoding, enabling unauthenticated attackers to insert and execute malicious scripts on pages viewed by users.

References