CVE-2026-14325
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using it as an HTML tag name in front-end output, allowing users with administrator access to inject arbitrary web scripts that execute on any front-end page rendering its upload field.
Risk Assessment
Administrators can inject malicious scripts that execute in visitors' browsers, potentially leading to data theft, session hijacking, or malware distribution.
Recommendation
Update the Drag and Drop Multiple File Upload for Contact Form 7 plugin to version 1.3.9.9 or later, which includes the escaping fix. Restrict administrator access to trusted individuals.
Other vulnerabilities in Drag and Drop Multiple File Upload for Contact Form 7
Original NVD description (English source)
The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using it as an HTML tag name in front-end output, allowing users with administrator access to inject arbitrary web scripts that execute on any front-end page rendering its upload field.