CVE-2026-49055

HighCVSS 7.1

Published: 15/06/2026(UTC)Updated: 25/10/2026(UTC)Translated: 16/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

Versions of Drag and Drop Multiple File Upload – Contact Form 7 up to 1.3.9.7 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.

Risk Assessment

This vulnerability may lead to user data theft or session hijacking, posing a serious threat to the application's security and the organization's data.

Recommendation

It is recommended to update the Drag and Drop Multiple File Upload – Contact Form 7 plugin to the latest version to mitigate this security vulnerability.

Other vulnerabilities in Drag and Drop Multiple File Upload – Contact Form 7

CVE-2025-14842Medium
The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to limited upload of files with a dangerous type in all versions up to, and including, 1.3.9.2. This is due to the plugin not blocking .phar and .svg files, allowing unauthenticated attackers to upload arbitrary .phar or .svg files containing malicious PHP or JavaScript code. Malicious PHP code can achieve remote code execution via direct file access if the server executes .phar as PHP, and .svg uploads allow Stored XSS under certain circumstances.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.9.7 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS