Ultimate Addons for Contact Form 7

Authenticated (Contributor+) Stored CrossSite Scripting via UACF7_CUSTOM_FIELDS Shortcode vulnerability <= 3.5.21

3.5.19 Unauthenticated Stored CrossSite Scripting vulnerability 3.5.11-3.5.19

Authenticated (Administrator+) Arbitrary File Upload via 'save_options' vulnerability <= 3.5.12

Unauthenticated Cross Site Scripting (XSS) vulnerability <= 3.2.0

Broken Access Control vulnerability <= 3.2.6