PULSE
EN
FEED
ransomhelix reclama a Hypertherm · US · Manufacturingransomeverest reclama a PLD Group · Otherransomeverest reclama a Lindauer Dornier · DE · Manufacturingransomeverest reclama a Lanham Associates · Professional Servicesransompear reclama a Adobe Insurance Brokers, LLC · US · Financial Servicesransomhyflock reclama a gabonmeca.com leak incident · GA · Manufacturingransomhyflock reclama a dangvuongcac · VN · Not Foundransomn0n reclama a Company #103 · PT · Not Foundransomn0n reclama a Company #102 · Not Foundransomn0n reclama a Company #101 · Not Foundransomn0n reclama a Company #100 · Not Foundransomn0n reclama a Company #99 · Not Foundransomn0n reclama a TheHomeMag NorCal · US · Retail & E-Commerceransomclop reclama a LEGAL-RECORDS.US · US · Professional Servicesransomhelix reclama a Hypertherm · US · Manufacturingransomeverest reclama a PLD Group · Otherransomeverest reclama a Lindauer Dornier · DE · Manufacturingransomeverest reclama a Lanham Associates · Professional Servicesransompear reclama a Adobe Insurance Brokers, LLC · US · Financial Servicesransomhyflock reclama a gabonmeca.com leak incident · GA · Manufacturingransomhyflock reclama a dangvuongcac · VN · Not Foundransomn0n reclama a Company #103 · PT · Not Foundransomn0n reclama a Company #102 · Not Foundransomn0n reclama a Company #101 · Not Foundransomn0n reclama a Company #100 · Not Foundransomn0n reclama a Company #99 · Not Foundransomn0n reclama a TheHomeMag NorCal · US · Retail & E-Commerceransomclop reclama a LEGAL-RECORDS.US · US · Professional Services
← Todos los CVEs
CVE Watch16 oct 2026

CVE-2026-103999

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to,

CVSS

7.2

Alto

EPSS

0.3%

p17

KEV

—

Exploit Today

5

0-100

Publicado: 16 oct 2026 · Última mod.: 16 oct 2026 · CWE-79

EPSS · 30d
0.3%EPSS · 30 días0.3%
2026-10-162026-10-20
Descripción técnica

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The extension blocklist gatekeeper is bypassed by uploading text-type files (.txt, .csv, .vtt, .srt, .asc) whose contents begin with an HTML payload such as '<BODY onload=…>', as the check classifies these files as text/plain without inspecting their byte content.

Referencias oficiales
CVEs relacionados
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1108997.1 ALT
—
——0Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.15.5.12hCVE-2026-1074357.1 ALT
—
——0Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.12.12hCVE-2026-1140614.7 MED
—
——0SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a <meta http-equiv="cache-control"> tag. An attacker who can influence that untrusted value at prerender time can break out of the content attribute and inject HTML or JavaScript that executes when users visit the page.19hCVE-2026-1137414.3 MED
—
——0A vulnerability has been found in itsourcecode Online Cake Ordering System 1.0. Affected by this issue is some unknown functionality of the file /404.php. Such manipulation of the argument useruid leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.19hCVE-2026-944026.1 MED
—
——0IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle() function re-inserts a substring of user-supplied label text into the DOM via an unsanitized innerHTML write when the title exceeds the available container width. A remote attacker could exploit this vulnerability to execute arbitrary JavaScript in the victim's browser session.21hCVE-2016-201026.1 MED
—
——0JavaMelody before 1.60.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted values in the graph parameter of /monitoring?part=graph. Attackers can include a closing script tag in the graph value, which is only JavaScript-escaped in HtmlCounterReport, to execute script in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.23h