CVE-2025-6756 – This stored XSS vulnerability in the Ultra Addo... (How to Fix)

Q: What is the severity of CVE-2025-6756?

CVE-2025-6756 has a CVSS score of 6.4 (MEDIUM). This stored XSS vulnerability in the Ultra Addons for Contact Form 7 WordPress plugin allows authenticated attackers with contributor-level access or higher to inject malicious scripts into website pages. The scripts execute whenever users visit compromised pages, potentially stealing credentials or performing unauthorized actions. All WordPress sites using vulnerable plugin versions are affected.

📋 TL;DR

This stored XSS vulnerability in the Ultra Addons for Contact Form 7 WordPress plugin allows authenticated attackers with contributor-level access or higher to inject malicious scripts into website pages. The scripts execute whenever users visit compromised pages, potentially stealing credentials or performing unauthorized actions. All WordPress sites using vulnerable plugin versions are affected.

💻 Affected Systems

Products:

Ultimate Addons for Contact Form 7 WordPress plugin

Versions: All versions up to and including 3.5.21

Operating Systems: All operating systems running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires WordPress installation with vulnerable plugin version and at least one contributor-level user account.

📦 What is this software?

Ultimate Addons For Contact Form 7 by Themefic

View all CVEs affecting Ultimate Addons For Contact Form 7 →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers gain administrative access, deface websites, steal sensitive user data, or install backdoors for persistent access.

🟠

Likely Case

Session hijacking, credential theft from users visiting infected pages, or redirection to malicious sites.

🟢

If Mitigated

Limited to low-privilege user compromise if proper input validation and output escaping are implemented.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authenticated access but is straightforward once credentials are obtained.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 3.5.22 or later

Vendor Advisory: https://wordpress.org/plugins/ultimate-addons-for-contact-form-7/#developers

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Ultimate Addons for Contact Form 7'. 4. Click 'Update Now' if available. 5. Alternatively, download version 3.5.22+ from WordPress repository and manually update.

🔧 Temporary Workarounds

Disable vulnerable shortcode

all

Remove or disable the UACF7_CUSTOM_FIELDS shortcode usage across the site

Edit WordPress pages/posts to remove [UACF7_CUSTOM_FIELDS] shortcode references

Restrict user roles

all

Temporarily remove contributor-level access until patching

Navigate to Users → All Users in WordPress admin, downgrade contributor roles to subscriber

🧯 If You Can't Patch

Disable the entire Ultimate Addons for Contact Form 7 plugin
Implement web application firewall rules to block XSS payloads targeting the vulnerable shortcode

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → Installed Plugins, find 'Ultimate Addons for Contact Form 7' and verify version is 3.5.21 or lower.

Check Version:

wp plugin list --name='ultimate-addons-for-contact-form-7' --field=version

Verify Fix Applied:

Confirm plugin version is 3.5.22 or higher in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

Unusual POST requests to WordPress admin-ajax.php with UACF7_CUSTOM_FIELDS parameters
Multiple failed login attempts followed by successful contributor-level login

Network Indicators:

HTTP requests containing script tags in UACF7_CUSTOM_FIELDS parameters
Outbound connections to suspicious domains from WordPress pages

SIEM Query:

source="wordpress.log" AND ("UACF7_CUSTOM_FIELDS" AND ("script" OR "onerror" OR "javascript:"))

📊 Metadata

CVE ID: CVE-2025-6756

CVSS v3 Score: 6.4 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

CWE: CWE-79

EPSS Score: 0.03% exploit probability (8.5th percentile)

Published: July 1, 2025

Last Updated: July 16, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-6756, you might also want to check these: