CVE-2026-14325: Stored XSS via drag_n_drop_heading_tag in Drag and Drop Multiple File Upload for Contact Form 7

Vulnerability Overview Vulnerability Name: Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Admin+ Stored XSS via drag_n_drop_heading_tag Setting Vulnerability Type: XSS (Cross-Site Scripting) Description: The plugin fails to escape its settings and directly uses them as HTML tag names in front-end output, allowing users with administrator privileges to inject arbitrary web scripts. These scripts execute on any front-end page that renders its upload field. CVE Number: CVE-2026-14325 CVSS Score: 3.5 (Low) Affected Scope Affected Plugin: Drag and Drop Multiple File Upload for Contact Form 7 Affected Versions: 1.3.9.9 and earlier Remediation Fixed Version: 1.3.9.9 Timeline Public Disclosure Date: 2026-08-19 Added Date: 2026-08-19 Last Updated Date: 2026-08-19 Additional Information Original Researcher: Sai Praneeth Koti Submitter: Sai Praneeth Koti Verification Status: Verified WPVDB ID: fc723849-62d3-4c87-a0ad-5e5354961303 Reference Links CVE Link: CVE-2026-14325 Classification OWASP Top 10: A7: Cross-Site Scripting (XSS) CWE: CWE-79 Related Vulnerabilities Notibar < 2.1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting Rimons Twitter Widget < 1.3 - XSS Webling < 3.9.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via "title" Parameter Gutenberg Blocks with AI by Kadence WP - Page Builder Features < 3.4.3 - Authenticated (contributor+) Stored Cross-Site Scripting via Button Link JSFiddle Shortcode < 1.1.3 - Contributor+ XSS via Shortcode POC Code POC Code: Specific POC code is not provided on the page; however, it is mentioned that the POC will be demonstrated on 2026-09-02 to give users time to update. --- The above is a summary of the key information regarding this vulnerability from the webpage screenshot.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-14325: Stored XSS via drag_n_drop_heading_tag in Drag and Drop Multiple File Upload for Contact Form 7

More from this source