Ultra Addons for Contact Form 7 up to version 3.5.54 is vulnerable to stored cross‑site scripting because the plugin does not properly sanitize or escape file contents uploaded through the interface. Unauthenticated users can upload a text‑type file whose first bytes contain an HTML payload, for example a body tag with an onload event, and that payload is stored and later rendered on pages. The result is that any visitor who views an injected page will have the attacker’s script executed in their browser, enabling cookie theft, session hijacking, defacement, and other malicious outcomes. The weakness corresponds to CWE‑79 input validation error.

The affected product is Ultra Addons for Contact Form 7 developed by themefic, a WordPress plugin. All release versions up to and including 3.5.54 are impacted. No other vendors or products are listed as affected.

With a CVSS score of 7.2 the vulnerability presents a moderate‑to‑high risk. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog, indicating it is not known to be actively exploited in the wild as of the time of this assessment. The likely attack vector is unauthenticated file upload: the attacker can simply upload a malicious otherwise‑text file through the plugin’s interface or a front‑end form, bypassing the blocklist gatekeeper that only checks MIME type names. Once the file is stored, any site visitor’s browser that loads a page referencing the file will execute the malicious script. Because authentication is not required, the potential offender could be anyone with network access to the WordPress site.