EUVD-2026-63815
GHSA-42hj-5w59-p3r2
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Admin-only setting write (PR:H) triggers stored XSS read by visitors (UI:R); limited confidentiality and integrity impact, no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using it as an HTML tag name in front-end output, allowing users with administrator access to inject arbitrary web scripts that execute on any front-end page rendering its upload field.
AnalysisAI
Stored XSS in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin (versions before 1.3.9.9) allows administrator-level users to inject arbitrary JavaScript via an unsanitized plugin setting used as an HTML tag name in front-end output. Any visitor loading a page that renders the upload field will execute the injected script in their browser context. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress administrator account - the CVSS vector PR:H confirms high-privilege authentication is mandatory. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.5 base score reflects the high-privilege prerequisite (PR:H) and required user interaction (UI:R), which substantially limits the attack surface - exploitation requires an authenticated WordPress administrator to first set the malicious payload via the plugin's admin panel. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained WordPress administrator credentials - through phishing, credential reuse, or a separate authentication bypass - navigates to the Drag and Drop Multiple File Upload plugin settings and enters a crafted string as the HTML tag name field. Upon saving, any front-end page rendering the plugin's upload widget will include the attacker's payload in the page DOM, executing arbitrary JavaScript in every visiting user's browser. … |
| Remediation | Upgrade the Drag and Drop Multiple File Upload for Contact Form 7 plugin to version 1.3.9.9 or later, which contains the vendor-released patch addressing this XSS issue. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution via file upload bypass in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plug
Stored Cross-Site Scripting in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin (all versions
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allSame technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today