Description

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using it as an HTML tag name in front-end output, allowing users with administrator access to inject arbitrary web scripts that execute on any front-end page rendering its upload field.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-08-21T07:16:24.430Z",
  "pubdate": "2026-08-21T07:16:24.430Z",
  "executiveSummary": "The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before version 1.3.9.9 suffers from an improper input neutralization vulnerability, specifically failing to adequately sanitize plugin settings prior to front-end rendering.\nThis vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue. The flaw enables authenticated users possessing administrative privileges to inject arbitrary web scripts or malicious HTML payloads into specific plugin configuration settings.\nUpon saving the malicious configuration, the unescaped setting is dynamically utilized as an HTML tag name within the Document Object Model (DOM) whenever the affected upload field is rendered on any front-end page.\nConsequently, when a victim or unauthenticated visitor browses a page containing the vulnerable upload component, the injected script executes within the context of their browser session.\nThe risk implications include potential session hijacking, unauthorized administrative action execution, and defacement or redirection of front-end web resources.\nExploitation requires authenticated administrative access to the WordPress backend to modify the vulnerable plugin settings, combined with subsequent front-end interaction by visiting users to trigger the payload execution.",
  "technicalDetails": "The root cause of this vulnerability lies in the lack of proper output encoding and input sanitization within the Drag and Drop Multiple File Upload for Contact Form 7 plugin prior to version 1.3.9.9.\nSpecifically, the affected component fails to validate or escape a designated configuration setting before concatenating it directly into front-end markup as an active HTML tag name.\nBecause the input is treated as structural markup rather than plain text or attribute data, an attacker with administrative privileges can supply specialized payloads designed to manipulate HTML parsing mechanics.\nThe attack flow proceeds as follows: First, an authenticated malicious administrator navigates to the plugin settings panel within the WordPress dashboard.\nSecond, the administrator inputs a crafted string containing malicious script tags, event handlers, or malformed tag constructs into the vulnerable setting field and saves the configuration.\nThird, the plugin securely stores this malicious string in the database without performing necessary sanitization or output escaping operations.\nFourth, when any front-end visitor requests a page rendering the Contact Form 7 upload field, the plugin dynamically constructs the HTML output using the unsanitized setting as an HTML element identifier.\nFifth, the browser parses the resulting HTML, interprets the injected sequence as a legitimate or script-executing HTML element, and executes the embedded arbitrary JavaScript in the context of the victim's browser session.\nAuthentication and privilege requirements mandate that the threat actor holds administrative access to the WordPress installation to modify the underlying plugin options.\nThe network exposure includes all front-end web pages where the Contact Form 7 upload shortcode or block is deployed, exposing visiting users to payload execution.\nPost-exploitation impact encompasses arbitrary JavaScript execution in the browser of any user viewing the affected page, facilitating potential session theft, credential harvesting, or further escalation if administrative users visit the compromised front-end page."
}