CVE-2026-8991: Stored XSS in Drag and Drop Multiple File Upload for Contact Form 7 Plugin

Technical summary

The vulnerability exists in the 'drag_n_drop_text' and 'drag_n_drop_browse_text' configuration parameters within the plugin. These fields fail to properly sanitize user input before storage and do not escape output when rendered on the front end, enabling stored XSS injection. The attack vector requires network access and high-privilege credentials (administrator level or above), but does not require user interaction to execute the injected payload once stored. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation).

Business impact

A compromised administrator account could deface contact forms, inject credential-harvesting scripts, or distribute malware to all site visitors interacting with affected forms. This undermines trust in the website and could facilitate data theft from end users. The impact is amplified on high-traffic sites where the form is frequently accessed. Organizations relying on contact forms for customer communication face potential reputation damage and regulatory exposure if user data is exfiltrated.

Affected systems

The Drag and Drop Multiple File Upload for Contact Form 7 plugin is affected in all versions up to and including 1.3.9.7. Sites running this plugin are at risk if administrator credentials have been compromised, or if administrative users are socially engineered or coerced into accepting malicious settings changes. The plugin's presence in a WordPress installation does not automatically trigger the vulnerability; an authenticated attacker with high privileges must actively inject the payload.

Exploitability

Exploitation requires authenticated access with administrator-level privileges, which significantly limits the attack surface compared to unauthenticated exploits. The CVSS score of 4.4 (Medium) reflects this constraint. An attacker cannot exploit the vulnerability through a remote, unauthenticated vector; however, once injected, the payload persists and executes automatically for all site visitors. This makes it particularly dangerous in scenarios where administrative accounts are compromised via credential theft, phishing, or supply-chain compromise.

Remediation

Update the Drag and Drop Multiple File Upload for Contact Form 7 plugin to a version newer than 1.3.9.7 that includes proper input sanitization and output escaping for the affected settings fields. Organizations should also review recent changes to plugin settings and check administrator activity logs for unauthorized modifications. Reset administrator credentials if compromise is suspected, and consider implementing role-based restrictions to limit which users can modify critical plugin settings.

Patch guidance

WordPress administrators should navigate to their plugins dashboard, locate 'Drag and Drop Multiple File Upload for Contact Form 7,' and check for available updates beyond version 1.3.9.7. Apply the patch immediately upon availability. Before updating, ensure backups of the site database and configuration are in place. Test the update in a staging environment if possible to verify compatibility with custom configurations. After patching, verify that the 'drag_n_drop_text' and 'drag_n_drop_browse_text' fields render correctly and no stored scripts persist from prior injection attempts.

Detection guidance

Review plugin settings and administrator modification logs for suspicious changes to the 'drag_n_drop_text' or 'drag_n_drop_browse_text' fields, particularly any entries containing HTML tags, script tags, or JavaScript event handlers. Use WordPress security plugins or database queries to search the options table for script-like content in these fields. Monitor browser developer consoles on pages displaying the contact form for unexpected script execution. Enable and review WordPress security audit logs to identify unauthorized administrator account activity around the time of suspected injection.

Why prioritize this

Although the CVSS score is Medium (4.4), this vulnerability should be prioritized for patching because: (1) stored XSS enables persistent attacks affecting all users of the site; (2) it targets a commonly-used form plugin, expanding potential reach; (3) exploitation indicators may be difficult to detect without active monitoring; (4) the attack persists until remediated, creating a prolonged exposure window. Organizations with high-value contact forms or those handling sensitive customer data should prioritize this patch within their standard update cycle.

Risk score, explained

The CVSS 3.1 score of 4.4 (Medium) is driven by the attack vector requiring high privileges (PR:H), no user interaction needed to execute stored payload (UI:N), complex access conditions (AC:H), and limited scope of impact (CIA:L for Confidentiality and Integrity, none for Availability). The score appropriately reflects that while exploitation is constrained by authentication requirements, the persistent nature of stored XSS and its affect on multiple users elevates the practical risk beyond a simple Low classification.

Frequently asked questions