CVE-2026-12801 is a stored cross-site scripting vulnerability in the Ultra Addons for Contact Form 7 plugin for WordPress. The flaw exists in the handling of the Range Slider's 'data-label' and 'data-separator' attributes, where input is not properly sanitized or escaped before being rendered in web pages. Authenticated attackers with contributor-level privileges or above can exploit this to inject arbitrary scripts that execute in the context of users viewing the injected pages. The vulnerability affects all versions up to and including 3.5.43.

Successful exploitation allows an authenticated contributor or higher to inject malicious scripts that execute in the browsers of users who visit the compromised pages. This can lead to data theft, session hijacking, or other actions permitted by the victim's browser context. The vulnerability does not require user interaction beyond page access and does not impact availability. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and partial confidentiality and integrity impact.

No official patch or remediation guidance is currently provided by the vendor. Users should monitor the vendor's advisory channels for updates. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Ultra Addons for Contact Form 7 plugin if possible to mitigate risk.