Ultra Addons for Contact Form 7 vulnerabilities
5 known vulnerabilities in Ultra Addons for Contact Form 7 from Themefic. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
Ultra Addons for Contact Form 7: Improper Limitation of a Pathname to a Restricted Directory
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.5.54 via the uacf7_wpcf7_mail_components function. This makes it possible for unauthenticated attackers to read the contents o
- 9.8 Critical severity
Ultra Addons for Contact Form 7: Deserialization of Untrusted Data
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the _getObjAttr function in all versions up to, and including, 3.5.54. This makes it possible for unauthenticated atta
- 7.2 High severity
Ultra Addons for Contact Form 7: Improper Neutralization of Input During Web Page Generation
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 due to insufficient input sanitization and output escaping. This makes it possible for unauthenti
- 9.8 Critical severity
Ultra Addons for Contact Form 7: Unrestricted Upload of File with Dangerous Type
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7_wpcf7_mail_components' function in all versions up to, and including, 3.5.50. This makes it possible for unau
- 7.2 High severity
Ultra Addons for Contact Form 7: Unrestricted Upload of File with Dangerous Type
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_options' function in all versions up to, and including, 3.5.12. This makes it possible for authenticated attackers