Stored Cross-Site Scripting Vulnerability in Ultra Addons for Contact Form 7 WordPress Plugin

CVE-2026-103999

What is CVE-2026-103999?

The Ultra Addons for Contact Form 7 plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) through File Upload due to inadequate input sanitization and output escaping. This vulnerability allows unauthenticated attackers to inject malicious web scripts into pages that execute whenever affected users access them. The vulnerability arises from the ability to upload seemingly benign text files (e.g., .txt, .csv, .vtt, .srt, .asc) that contain HTML payloads. The plugin's file type validation fails to properly scrutinize the contents of these files, classifying them as text/plain without evaluating their byte content, thus permitting XSS attacks.

References