Description

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Range Slider 'data-label' and 'data-separator' attributes in all versions up to, and including, 3.5.43 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-07T05:16:57.607Z",
  "pubdate": "2026-08-07T05:16:57.607Z",
  "executiveSummary": "The Ultra Addons for Contact Form 7 plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to, and including, 3.5.43.\nThis security defect arises due to insufficient input sanitization and inadequate output escaping implemented on specific attributes within the Range Slider component.\nAuthenticated malicious actors possessing contributor-level access privileges or higher can successfully inject arbitrary web scripts or HTML payloads into the affected parameters.\nWhen a victimized user accesses a web page rendering the injected payload, the malicious script executes within the context of the user's browser session.\nThe primary impact of this vulnerability includes potential session hijacking, unauthorized interaction with the WordPress site via the victim's privileges, and the execution of unauthorized client-side actions.\nSuccessful exploitation requires authentication and a minimum privilege level of a contributor, along with user interaction where an authenticated or unauthenticated user visits the compromised page depending on site configuration.",
  "technicalDetails": "The vulnerability is classified as Stored Cross-Site Scripting (XSS), stemming from improper input validation and output encoding weaknesses located within the Range Slider feature of the Ultra Addons for Contact Form 7 plugin.\nSpecifically, the vulnerable component fails to properly sanitize user-supplied data submitted through the 'data-label' and 'data-separator' attributes prior to persisting this input into the database or rendering it back to the client-side interface.\nThe affected product versions encompass all iterations of the Ultra Addons for Contact Form 7 plugin up to and including version 3.5.43.\nExploitation of this flaw requires an attacker to authenticate to the WordPress platform with a minimum role of a contributor, allowing them to create or edit content containing the malicious Contact Form 7 elements.\nThe attack flow proceeds as follows: First, the authenticated attacker crafts a malicious payload incorporating arbitrary JavaScript into the 'data-label' or 'data-separator' attributes of the Range Slider form element. Second, the attacker saves the form configuration, causing the unsanitized input to be stored persistently within the database. Third, when a user accesses a front-end or back-end page rendering the vulnerable form, the server outputs the stored attributes without proper context-aware escaping. Finally, the victim's browser interprets the injected string as executable script code rather than benign text, executing the arbitrary payload within the security context of the victim's browser session.\nBecause the script executes in the victim's browser, post-exploitation impact can range from the theft of session cookies and sensitive authentication tokens to unauthorized modifications of site content or administrative actions, depending on the privilege level of the user viewing the injected page."
}