themefic has 2 CVEs on record. 2 were published in the last 90 days. The median CVSS is 8.2 (high), with 1 rated critical.
CVEs per month
Last 12 months, by publish date
1025/101125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/09
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.2
- Publish → KEV
- —
- Last 90 days
- 2 prev 0
Products
- Ultra Addons for Contact Form 7 1
- ultimate-addons-for-contact-form-7 1
2
Total CVEs
1
Critical
0
CISA KEV
0
Exploited
Worst active — by depth score
CVE-2026-82901Critical· 9.8The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7_wpcf7_mail_components' function in all versions up to, and including, 3.5.5054CVE-2026-95586Medium· 6.5Contributor Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <= 3.5.50 versions.36
themefic vulnerabilities
CVEs affecting themefic, newest first. Open any entry for full detail, references, and exploit status.
2 CVEsRSS
CVE-2026-82901Critical· 9.8The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7_wpcf7_mail_components' function in all versions up to, and including, 3.5.50
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7_wpcf7_mail_components' function in all versions up to, and including, 3.5.50. This mak…
▾ Midnightthemefic · Ultra Addons for Contact Form 7via NVD
CVE-2026-95586Medium· 6.5Contributor Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <= 3.5.50 versions.
Contributor Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <= 3.5.50 versions.
▾ SunlitThemefic · ultimate-addons-for-contact-form-7EPSS 0.16%via NVD