Skip to content
PluginCanary

Ultra Addons for Contact Form 7

by Themefic · 60,000+ active installs · Checked 3 Nov 2026
Healthy6 Warnings

Healthy: vulnerability published 2 Nov 2026, fixed in 3.5.55.

86/ 100 Canary Score
Sub-scores for Ultra Addons for Contact Form 7
Ownership100
Maintenance100
Security60
Support88
Reputation85

How the score works

Active signals

Facts we detected, with links to the source.

  • WarningSEC-1Vulnerability published 2 Nov 2026, fixed in 3.5.55. Update to version 3.5.55 or later.2 Nov 2026Evidence
  • WarningSEC-1Vulnerability published 15 Oct 2026, fixed in 3.5.55. Update to version 3.5.55 or later.15 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 26 Sep 2026, fixed in 3.5.51. Update to version 3.5.51 or later.26 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 24 Sep 2026, fixed in 3.5.52. Update to version 3.5.52 or later.24 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 22 Sep 2026, fixed in 3.5.51. Update to version 3.5.51 or later.22 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 17 Sep 2026, fixed in 3.5.51. Update to version 3.5.51 or later.17 Sep 2026Evidence
  • InfoSEC-314 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
plugin-master3 Feb 2021 to 3 Feb 2021, 1 commits
psdtowpservice4 Feb 2021 to 24 Jun 2024, 214 commits
themefic15 Nov 2021 to 1 Nov 2026, 93 commits
mdashikul23 Mar 2025 to 23 Sep 2026, 41 commits

4 committers recorded. No ownership changes recorded since 3 Nov 2026.

Maintenance

Last release
3 days ago
Releases, 24 months
68
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter for Ultra Addons for Contact Form 7
Q1 202411
Q2 20248
Q3 20249
Q4 202411
Q1 202511
Q2 202513
Q3 20257
Q4 20255
Q1 20265
Q2 20266
Q3 20267
Q4 20265

Last release 1 Nov 2026. Tested with WordPress 7.1 (current).

Support

88% of 8 support threads resolved in the last 2 months.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
2 Nov 2026Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field9.8<= 3.5.543.5.550
15 Oct 2026Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Stored Cross-Site Scripting via File Upload7.2<= 3.5.543.5.550
26 Sep 2026Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field9.8<= 3.5.503.5.510
24 Sep 2026Ultra Addons for Contact Form 7 <= 3.5.51 - Authenticated (Editor+) PHP Object Injection6.6<= 3.5.513.5.520
22 Sep 2026Ultra Addons for Contact Form 7 <= 3.5.50 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 3.5.503.5.510
17 Sep 2026Ultimate Addons for Contact Form 7 3.2.4 - 3.5.50 - Unauthenticated Arbitrary File Upload9.83.2.4 to 3.5.503.5.510
6 Aug 2026Ultra Addons for Contact Form 7 <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Attributes6.4<= 3.5.433.5.440
27 Jul 2026Ultimate Addons for Contact Form 7 <= 3.5.45 - Unauthenticated Stored Cross-Site Scripting7.2<= 3.5.453.5.460
14 Mar 2026Ultra Addons for Contact Form 7 <= 3.5.36 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 3.5.363.5.370
13 Dec 2025Ultimate Addons for Contact Form 7 <= 3.5.34 - Missing Authorization5.3<= 3.5.343.5.3526
11 Dec 2025Ultra Addons for Contact Form 7 <= 3.5.33 - Missing Authorization to Authenticated (Subscriber+) to Generate Form Submission PDF4.3<= 3.5.333.5.340
30 Jun 2025Ultra Addons for Contact Form 7 <= 3.5.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via UACF7_CUSTOM_FIELDS Shortcode6.4<= 3.5.213.5.220
25 Jun 2025Ultra Addons for Contact Form 7 3.5.11 - 3.5.19 - Unauthenticated Stored Cross-Site Scripting via Database module7.23.5.11 to 3.5.193.5.200
17 Jun 2025Ultimate Addons for Contact Form 7 <= 3.5.12 - Authenticated (Administrator+) Arbitrary File Upload via 'save_options'7.2<= 3.5.123.5.130
4 Dec 2023Ultimate Addons for Contact Form 7 <= 3.2.0 - Reflected Cross-Site Scripting6.1<= 3.2.03.2.10
9 Nov 2023Ultimate Addons for Contact Form 7 <= 3.2.10 - Missing Authorization5.3<= 3.2.103.2.1112
28 Aug 2023Ultimate Addons for Contact Form 7 <= 3.1.0 - Reflected Cross-Site Scripting via 'page'6.1<= 3.1.03.1.20
24 Jul 2023Ultimate Addons for Contact Form 7 <= 3.1.28 - Reflected Cross-Site Scripting6.1< 3.1.293.1.290
24 Jul 2023Ultimate Addons for Contact Form 7 <= 3.1.28 - Authenticated (Admin+) Stored Cross-Site Scripting4.4< 3.1.293.1.290
8 Jun 2023Ultimate Addons for Contact Form 7 <= 3.1.23 - Authenticated(Subscriber+) SQL Injection8.83.1.233.1.240
9 May 2023Ultimate Addons for Contact Form 7 <= 3.1.23 - Unauthenticated SQL Injection via form_id9.8<= 3.1.233.1.240
24 Apr 2023Ultimate Addons for Contact Form 7 <= 3.1.23 - Authenticated (Subscriber+) SQL Injection via id8.8<= 3.1.233.1.240

Source: Wordfence Intelligence.

Reputation

Average rating per quarter for Ultra Addons for Contact Form 7
Q4 20243.0
Q1 20255.0
Q2 20255.0
Q3 20254.3
Q4 20255.0
Q1 20265.0
Q2 20265.0
Q3 20265.0
Q4 20265.0

Average rating rose from 3.0 to 5.0 between Q4 2024 and Q4 2026.

Rating distribution
5 star100
4 star4
3 star1
2 star0
1 star3
Latest low reviews

Momentum

60,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Ultra Addons for Contact Form 7
4 May 202611,875
11 May 202613,786
18 May 20266,063
25 May 202624,602
1 Jun 20264,338
8 Jun 20263,009
15 Jun 20262,414
22 Jun 202637,608
29 Jun 20266,092
6 Jul 20265,341
13 Jul 202611,694
20 Jul 202616,032
27 Jul 202625,387
3 Aug 20267,743
10 Aug 20263,029
17 Aug 20263,897
24 Aug 202621,266
31 Aug 202624,392
7 Sep 202623,376
14 Sep 202625,477
21 Sep 202628,057
28 Sep 20268,437
5 Oct 202656,534
12 Oct 20268,403
19 Oct 20265,354
26 Oct 202632,899
2 Nov 202611,188

Weekly downloads over the last 4 weeks are 9% below the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

گرویتی فرم فارسی | Persian Gravity FormsScore 92 · 20,000+Database Addon For WPForms ( wpforms entries ) - WPFormsDBScore 92 · 20,000+Database Addon for Contact Form 7 - CFDB7Score 91 · 600,000+CF7 Apps - Addons for Contact Form 7 (Honeypot, Database, Redirection, Webhook, etc.)Score 91 · 300,000+Image CAPTCHA for Contact Form 7 and WPForms by HookAndHook (DSGVO/GDPR)Score 91 · 70,000+

Facts

Version3.5.57
AuthorThemefic
Added4 Feb 2021
Last updated1 Nov 2026
Active installs60,000+
Requires WordPress6.8
Tested up to7.1.4
Requires PHP7.4
CategoryForms & Data Collection > Form Builders & Creators
Tagsforms, custom form, contact form, form builder, contact form 7

Other plugins by this author: Ultimate Before After Image Slider & Gallery - BEAF, Hydra Booking - Appointment Scheduling & Booking Calendar, Tourfic - AI Powered Travel Booking, Hotel Booking & Car Rental, Tourfic Toolkit, Instantio - Side Cart & One-Page Checkout for WooCommerce, Ultra Addons for WPForms

Questions

Is Ultra Addons for Contact Form 7 still maintained?

Ultra Addons for Contact Form 7 was last updated on 1 Nov 2026. Its Canary status is Healthy.

Is Ultra Addons for Contact Form 7 safe?

Ultra Addons for Contact Form 7 has no open unpatched vulnerabilities on record. 14 vulnerabilities were published in the last 24 months. Its Canary status is Healthy.

Who owns Ultra Addons for Contact Form 7?

The wordpress.org author is Themefic. Recent committers: themefic, mdashikul, psdtowpservice, plugin-master. We have recorded no ownership change.

What can I use instead of Ultra Addons for Contact Form 7?

Plugins in the same category with a higher Canary Score: گرویتی فرم فارسی | Persian Gravity Forms, Database Addon For WPForms ( wpforms entries ) - WPFormsDB, Database Addon for Contact Form 7 - CFDB7, CF7 Apps - Addons for Contact Form 7 (Honeypot, Database, Redirection, Webhook, etc.), Image CAPTCHA for Contact Form 7 and WPForms by HookAndHook (DSGVO/GDPR).

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue