CVE-2026-8991

MediumCVSS 4.4

Published: 06/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

12th percentile - higher than 12% of all known CVEs

Summary

The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress up to version 1.3.9.7 is vulnerable to Stored Cross-Site Scripting via the 'drag_n_drop_text' and 'drag_n_drop_browse_text' settings due to insufficient input sanitization and output escaping.

Risk Assessment

An authenticated attacker with administrator-level access or higher can inject arbitrary web scripts that execute whenever a user accesses an injected page, potentially leading to data theft or session hijacking.

Recommendation

Immediately update the plugin to the latest available version and restrict administrator privileges to trusted users only.

Other vulnerabilities in Drag and Drop Multiple File Upload for Contact Form 7

CVE-2026-14325Low
The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using it as an HTML tag name in front-end output, allowing users with administrator access to inject arbitrary web scripts that execute on any front-end page rendering its upload field.

Original NVD description (English source)

The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'drag_n_drop_text' and 'drag_n_drop_browse_text' Settings in all versions up to, and including, 1.3.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.