EUVD-2026-36868
GHSA-6wvr-3ch8-8c9p
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Network-delivered via form submission (AV:N/AC:L/PR:N), payload fires only when a user views it (UI:R), and execution in the admin's browser crosses a trust boundary into WordPress (S:C) with limited C/I/A.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Drag and Drop Multiple File Upload - Contact Form 7 <= 1.3.9.7 versions.
AnalysisAI
Unauthenticated reflected/stored cross-site scripting in the WordPress plugin Drag and Drop Multiple File Upload - Contact Form 7 versions 1.3.9.7 and earlier allows remote attackers to inject script that executes in a victim's browser after user interaction, leading to session theft, account takeover, or pivoting against authenticated administrators. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the Drag and Drop Multiple File Upload - Contact Form 7 plugin at version 1.3.9.7 or earlier to be installed and active on a WordPress site with at least one Contact Form 7 form using the drag-and-drop upload field, plus a victim (typically a logged-in administrator or moderator) being induced to view the page that renders the unsanitized attacker input - the CVSS UI:R requirement. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L indicates a network-reachable, low-complexity flaw exploitable without authentication but requiring user interaction, with low impact across a changed scope - typical of XSS that pivots from the public site into the admin context. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker submits a contact form on a target WordPress site, embedding a JavaScript payload in a field (such as a manipulated filename or form parameter) processed by the vulnerable plugin. When a site administrator later reviews the submission in the WordPress dashboard or when the rendered output is viewed by another user, the payload executes in that user's browser session, allowing cookie/session theft, CSRF-driven plugin installation, or creation of a rogue administrator account. |
| Remediation | Upstream fix available per the Patchstack advisory; released patched version not independently confirmed from the provided data, so administrators should update the Drag and Drop Multiple File Upload - Contact Form 7 plugin to the latest available version greater than 1.3.9.7 from the WordPress plugin repository and verify the installed version after upgrade (advisory: https://patchstack.com/database/wordpress/plugin/drag-and-drop-multiple-file-upload-contact-form-7/vulnerability/wordpress-drag-and-drop-multiple-file-upload-contact-form-7-plugin-1-3-9-7-cross-site-scripting-xss-vulnerability). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all WordPress installations using this plugin and verify versions in use. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today