CVE-2026-14325: Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Admin+ Stored XSS via drag_n_drop_heading_tag Setting
The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using it as an HTML tag name in front-end output, allowing users with administrator access to inject arbitrary web scripts that execute on any front-end page rendering its upload field.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs administrator access to the WordPress site and the ability to modify the plugin setting used as the upload field heading tag. This is not described as exploitable by unauthenticated or lower-privileged users.
Where does the injected script execute?
The script executes in browsers viewing any front-end page that renders the plugin's upload field. An administrator can store the payload through the affected setting, causing it to be included in that front-end output.
Which installations are affected?
Versions of Drag and Drop Multiple File Upload for Contact Form 7 before 1.3.9.9 are affected. The available information does not state whether the vulnerable setting is enabled or populated by default.