Plugin security history

Ultra Addons for Contact Form 7 Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 15 vulnerability records associated with Ultra Addons for Contact Form 7, published between 2023 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

15Total records

1Critical

5High

9Medium

0Low

0Informational

15Patched records

0Currently marked unpatched

2023-04-24First disclosure

2026-07-27Latest disclosure

15 of 15CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2023	8	8 records
2025	5	5 records
2026	2	2 records

Severity Breakdown

Severity	Records	Share
Critical	1	6.7%
High	5	33.3%
Medium	9	60%

Vulnerability-Type Breakdown

Cross-Site Scripting

8 records53.3%

First: 2023. Latest: 2026.

SQL Injection

3 records20%

First: 2023. Latest: 2023.

Missing Authorization

3 records20%

First: 2023. Latest: 2025.

Arbitrary File Upload

1 record6.7%

First: 2025. Latest: 2025.

Patch Status

Patched: 15
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

3.5.46
3.5.37
3.5.35
3.5.34
3.5.22
3.5.20
3.5.13
3.2.1
3.2.11
3.1.2
3.1.29
3.1.24

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-3.5.45`	Ultimate Addons for Contact Form 7 <= 3.5.45 - Unauthenticated Stored Cross-Site Scripting	July 27, 2026	3.5.46	High
`*-3.5.36`	Ultra Addons for Contact Form 7 <= 3.5.36 - Authenticated (Contributor+) Stored Cross-Site Scripting	March 14, 2026	3.5.37	Medium
`*-3.5.34`	Ultimate Addons for Contact Form 7 <= 3.5.34 - Missing Authorization	December 13, 2025	3.5.35	Medium
`*-3.5.33`	Ultra Addons for Contact Form 7 <= 3.5.33 - Missing Authorization to Authenticated (Subscriber+) to Generate Form Submission PDF	December 11, 2025	3.5.34	Medium
`*-3.5.21`	Ultra Addons for Contact Form 7 <= 3.5.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via UACF7_CUSTOM_FIELDS Shortcode	June 30, 2025	3.5.22	Medium
`3.5.11-3.5.19`	Ultra Addons for Contact Form 7 3.5.11 - 3.5.19 - Unauthenticated Stored Cross-Site Scripting via Database module	June 25, 2025	3.5.20	High
`*-3.5.12`	Ultimate Addons for Contact Form 7 <= 3.5.12 - Authenticated (Administrator+) Arbitrary File Upload via 'save_options'	June 17, 2025	3.5.13	High
`*-3.2.0`	Ultimate Addons for Contact Form 7 <= 3.2.0 - Reflected Cross-Site Scripting	December 4, 2023	3.2.1	Medium
`*-3.2.10`	Ultimate Addons for Contact Form 7 <= 3.2.10 - Missing Authorization	November 9, 2023	3.2.11	Medium
`*-3.1.0`	Ultimate Addons for Contact Form 7 <= 3.1.0 - Reflected Cross-Site Scripting via 'page'	August 28, 2023	3.1.2	Medium
`[*, 3.1.29)`	Ultimate Addons for Contact Form 7 <= 3.1.28 - Authenticated (Admin+) Stored Cross-Site Scripting	July 24, 2023	3.1.29	Medium
`[*, 3.1.29)`	Ultimate Addons for Contact Form 7 <= 3.1.28 - Reflected Cross-Site Scripting	July 24, 2023	3.1.29	Medium
`3.1.23`	Ultimate Addons for Contact Form 7 <= 3.1.23 - Authenticated(Subscriber+) SQL Injection	June 8, 2023	3.1.24	High
`*-3.1.23`	Ultimate Addons for Contact Form 7 <= 3.1.23 - Unauthenticated SQL Injection via form_id	May 9, 2023	3.1.24	Critical
`*-3.1.23`	Ultimate Addons for Contact Form 7 <= 3.1.23 - Authenticated (Subscriber+) SQL Injection via id	April 24, 2023	3.1.24	High

Selected source records

Latest Records

HighCVE-2026-65439

Ultimate Addons for Contact Form 7 <= 3.5.45 - Unauthenticated Stored Cross-Site Scripting

Published: July 27, 2026

Affected versions: *-3.5.45
Patched versions: 3.5.46

Original Wordfence record

MediumCVE-2026-32460

Ultra Addons for Contact Form 7 <= 3.5.36 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: March 14, 2026

Affected versions: *-3.5.36
Patched versions: 3.5.37

Original Wordfence record

MediumCVE-2026-24945

Ultimate Addons for Contact Form 7 <= 3.5.34 - Missing Authorization

Published: December 13, 2025

Affected versions: *-3.5.34
Patched versions: 3.5.35

Original Wordfence record

MediumCVE-2025-14356

Ultra Addons for Contact Form 7 <= 3.5.33 - Missing Authorization to Authenticated (Subscriber+) to Generate Form Submission PDF

Published: December 11, 2025

Affected versions: *-3.5.33
Patched versions: 3.5.34

Original Wordfence record

MediumCVE-2025-6756

Ultra Addons for Contact Form 7 <= 3.5.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via UACF7_CUSTOM_FIELDS Shortcode

Published: June 30, 2025

Affected versions: *-3.5.21
Patched versions: 3.5.22

Original Wordfence record

HighCVE-2025-6212

Ultra Addons for Contact Form 7 3.5.11 - 3.5.19 - Unauthenticated Stored Cross-Site Scripting via Database module

Published: June 25, 2025

Affected versions: 3.5.11-3.5.19
Patched versions: 3.5.20

Original Wordfence record

HighCVE-2025-6220

Ultimate Addons for Contact Form 7 <= 3.5.12 - Authenticated (Administrator+) Arbitrary File Upload via 'save_options'

Published: June 17, 2025

Affected versions: *-3.5.12
Patched versions: 3.5.13

Original Wordfence record

MediumCVE-2023-49766

Ultimate Addons for Contact Form 7 <= 3.2.0 - Reflected Cross-Site Scripting

Published: December 4, 2023

Affected versions: *-3.2.0
Patched versions: 3.2.1

Original Wordfence record

Highest-Severity Records

CriticalCVE-2022-47586

Ultimate Addons for Contact Form 7 <= 3.1.23 - Unauthenticated SQL Injection via form_id

Published: May 9, 2023

Affected versions: *-3.1.23
Patched versions: 3.1.24

Original Wordfence record

HighCVE-2023-30495

Ultimate Addons for Contact Form 7 <= 3.1.23 - Authenticated (Subscriber+) SQL Injection via id

Published: April 24, 2023

Affected versions: *-3.1.23
Patched versions: 3.1.24

Original Wordfence record

HighCVE-2023-1615

Ultimate Addons for Contact Form 7 <= 3.1.23 - Authenticated(Subscriber+) SQL Injection

Published: June 8, 2023

Affected versions: 3.1.23
Patched versions: 3.1.24

Original Wordfence record

HighCVE-2025-6220

Ultimate Addons for Contact Form 7 <= 3.5.12 - Authenticated (Administrator+) Arbitrary File Upload via 'save_options'

Published: June 17, 2025

Affected versions: *-3.5.12
Patched versions: 3.5.13

Original Wordfence record

HighCVE-2026-65439

Ultimate Addons for Contact Form 7 <= 3.5.45 - Unauthenticated Stored Cross-Site Scripting

Published: July 27, 2026

Affected versions: *-3.5.45
Patched versions: 3.5.46

Original Wordfence record

HighCVE-2025-6212

Ultra Addons for Contact Form 7 3.5.11 - 3.5.19 - Unauthenticated Stored Cross-Site Scripting via Database module

Published: June 25, 2025

Affected versions: 3.5.11-3.5.19
Patched versions: 3.5.20

Original Wordfence record

MediumCVE-2026-32460

Ultra Addons for Contact Form 7 <= 3.5.36 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: March 14, 2026

Affected versions: *-3.5.36
Patched versions: 3.5.37

Original Wordfence record

MediumCVE-2025-6756

Ultra Addons for Contact Form 7 <= 3.5.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via UACF7_CUSTOM_FIELDS Shortcode

Published: June 30, 2025

Affected versions: *-3.5.21
Patched versions: 3.5.22

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory