CVE-2026-103999: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in themefic Ultra Addons for Contact Form 7

CVE-2026-103999 is a stored cross-site scripting vulnerability in the themefic Ultra Addons for Contact Form 7 WordPress plugin. Versions up to and including 3.5.54 are vulnerable due to insufficient sanitization and escaping of uploaded file contents. Attackers can bypass the plugin's file type blocklist by uploading text-based files (.txt, .csv, .vtt, .srt, .asc) that start with an HTML payload such as '<BODY onload=…>'. These files are treated as text/plain without deeper content inspection, enabling injection of arbitrary web scripts that execute when users view affected pages.

An unauthenticated attacker can inject and store malicious scripts in the plugin via crafted file uploads. These scripts execute in the context of users visiting the affected pages, potentially leading to session hijacking, data theft, or other client-side attacks. The vulnerability has a CVSS 3.1 score of 7.2 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity with scope change.

No official patch or fix is currently documented. Users should monitor the vendor's advisory for updates. Until a fix is available, restrict file upload permissions and avoid using vulnerable versions. Consider disabling or limiting the plugin's file upload features to mitigate risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.