CVE-2026-103999 themefic CVE debrief

Who should care

Defenders responsible for WordPress installations with the Ultra Addons for Contact Form 7 plugin should assess exposure and prioritize verification and remediation efforts. This includes reviewing compensating controls, monitoring, and asset inventory to prevent exploitation.

Why it matters

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload, allowing unauthenticated attackers to inject arbitrary web scripts.

• Unauthenticated attackers can inject arbitrary web scripts in pages.
• Injected scripts execute whenever a user accesses an injected page.
• Verify and update the Ultra Addons for Contact Form 7 plugin to prevent exploitation.
• Restrict file uploads to only allow specific file types.

Technical summary

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 due to insufficient input sanitization and output escaping. The extension blocklist gatekeeper is bypassed by uploading text-type files (.txt, .csv, .vtt, .srt, .asc) whose contents begin with an HTML payload, allowing unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Defenders should prioritize verifying and updating the Ultra Addons for Contact Form 7 plugin to prevent exploitation.

Defensive priority

Defenders should prioritize verifying and updating the Ultra Addons for Contact Form 7 plugin to prevent exploitation.

Recommended defensive actions

• Verify and update the Ultra Addons for Contact Form 7 plugin to the latest version.
• Restrict file uploads to only allow specific file types.
• Implement additional security measures to detect and prevent cross-site scripting attacks.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The extension blocklist gatekeeper is bypassed by uploading text-type files (.txt, .csv, .vtt, .srt, .asc) whose contents begin with an HTML payload. The CVE record was published on 2026-10-16T06:17:03.927Z and has not been modified since then. Evidence is limited to the official CVE Program record and NIST NVD detail page.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.