← CVE Intelligence

CVE-2026-14325

Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Admin+ Stored XSS via drag_n_drop_heading_tag Setting PUBLISHED

Description (CNA)

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using it as an HTML tag name in front-end output, allowing users with administrator access to inject arbitrary web scripts that execute on any front-end page rendering its upload field.

Affected (CNA)

Vendor / productVersions
Unknown / Drag and Drop Multiple File Upload for Contact Form 7affected 0 before 1.3.9.9

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.