CVE-2026-49055

7th percentile - higher than 7% of all known CVEs

Versions of Drag and Drop Multiple File Upload – Contact Form 7 up to 1.3.9.7 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.

This vulnerability may lead to user data theft or session hijacking, posing a serious threat to the application's security and the organization's data.

It is recommended to update the Drag and Drop Multiple File Upload – Contact Form 7 plugin to the latest version to mitigate this security vulnerability.