# CVE-2026-95586: Ultimate Addons for Contact Form 7 Cross Site Scripting

Source: https://junglewise.ai/threats/cve-2026-95586-contributor-cross-site-scripting-xss-in-ultimate-addons-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-95586 · Severity: medium · CVSS 6.5 · Published 2026-09-23

Ultimate Addons for Contact Form 7 is a WordPress plugin that extends the functionality of Contact Form 7, a popular form-building tool for websites. A Cross Site Scripting (XSS) vulnerability in versions 3.5.50 and earlier allows contributor-level users to inject malicious scripts into the site, which could be used to steal visitor data or hijack user accounts. The vulnerability requires user interaction, such as a privileged user clicking a malicious link or visiting a crafted page.

Vendors: [Themefic](https://junglewise.ai/threats/vendors/themefic).

## Quick answers

**Is CVE-2026-95586 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-95586 being exploited in the wild.

**How severe is CVE-2026-95586?** Medium severity, with a CVSS score of 6.5, published 23 September 2026.

**Which products and versions are affected?** Themefic Ultimate Addons for Contact Form 7 3.5.50 and earlier.

**Is there a fix for CVE-2026-95586?** A patch was published on 2026-09-22: Version 3.5.51 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-95586 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-95586?** Check whether you run Themefic Ultimate Addons for Contact Form 7 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored or reflected XSS vulnerability in Ultimate Addons for Contact Form 7 allows attackers with Contributor role privileges to inject arbitrary JavaScript that executes in the browser context of site visitors. The vulnerability is triggered through a form submission or crafted page interaction requiring user action. The issue was patched in version 3.5.51.

## Affected products

- Themefic Ultimate Addons for Contact Form 7 3.5.50 and earlier

## Timeline

- 2026-02-12: disclosed
- 2026-09-22: patched: Version 3.5.51 released

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/ultimate-addons-for-contact-form-7/vulnerability/wordpress-ultimate-addons-for-contact-form-7-plugin-3-5-50-cross-site-scripting-xss-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/ultimate-addons-for-contact-form-7/vulnerability/wordpress-ultimate-addons-for-contact-form-7-plugin-3-5-50-cross-site-scripting-xss-vulnerability?_s_id=cve)

## Related threats

- [Themefic Ultimate Addons for Contact Form 7 unauthenticated XSS](https://junglewise.ai/threats/cve-2026-65439-themefic-ultimate-addons-for-contact-form-7-unauthenticated-xss)