Cross-site Scripting Vulnerability in Themefic Ultimate Addons for Contact Form 7
CVE-2026-32460

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Ultimate Addons For Contact Form 7
Vendor
CVE Published:
13 March 2026

What is CVE-2026-32460?

A Cross-site Scripting (XSS) vulnerability exists in the Themefic Ultimate Addons for Contact Form 7, allowing attackers to inject malicious scripts via improperly sanitized input. This flaw arises from incorrectly configured access control security levels, which can permit unauthorized access to sensitive functionalities. It is crucial for websites using this plugin, particularly versions up to 3.5.36, to implement the recommended security measures to mitigate the risks associated with this vulnerability.

Affected Version(s)

Ultimate Addons for Contact Form 7 0 <= 3.5.36

References

https://patchstack.com/database/Wordpress/Plugin/ultimate...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marc-André Beaulieu (h3dg3h0g) | Patchstack Bug Bounty Program
.