What is the CVSS score of EUVD-2026-36868?

EUVD-2026-36868 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Drag and Drop Multiple File Upload - Contact Form 7 are affected by EUVD-2026-36868?

The Drag and Drop Multiple File Upload - Contact Form 7 WordPress plugin (v1.3.9.7 and earlier) contains an unauthenticated XSS vulnerability that enables attackers to inject malicious code into…

How to fix or mitigate EUVD-2026-36868?

Within 24 hours: Inventory all WordPress installations using this plugin and verify versions in use. Within 7 days: Either disable the plugin entirely or implement compensating controls (WAF rules blocking script injection, strict Content Security Policy headers). Within 30 days: Monitor vendor communications for patch release and plan immediate deployment across all affected instances; test in non-production environment before rollout.

Drag and Drop Multiple File Upload - Contact Form 7 EUVD-2026-36868

| CVE-2026-49055 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-15 Patchstack

GHSA-6wvr-3ch8-8c9p

File Upload XSS Drag And Drop Multiple File Upload Contact Form 7

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-delivered via form submission (AV:N/AC:L/PR:N), payload fires only when a user views it (UI:R), and execution in the admin's browser crosses a trust boundary into WordPress (S:C) with limited C/I/A.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 21:41 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Drag and Drop Multiple File Upload - Contact Form 7 <= 1.3.9.7 versions.

AnalysisAI

Unauthenticated reflected/stored cross-site scripting in the WordPress plugin Drag and Drop Multiple File Upload - Contact Form 7 versions 1.3.9.7 and earlier allows remote attackers to inject script that executes in a victim's browser after user interaction, leading to session theft, account takeover, or pivoting against authenticated administrators. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. CVSS 3.1 base score is 7.1 with a changed scope reflecting impact across the WordPress admin trust boundary.

Technical ContextAI

The vulnerable component is a WordPress plugin developed by Glen Don Mongaya that extends Contact Form 7 to accept drag-and-drop multi-file uploads (CPE cpe:2.3:a:glen_don_mongaya:drag_and_drop_multiple_file_upload_-_contact_form_7). The root cause class is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning attacker-controlled input is reflected into HTML/JavaScript context without proper output encoding or contextual sanitization. Because Contact Form 7 add-ons typically process form submissions and render filenames or form parameters in the WordPress admin or front-end pages, the injection sink is reachable from an unauthenticated submission path.

RemediationAI

Upstream fix available per the Patchstack advisory; released patched version not independently confirmed from the provided data, so administrators should update the Drag and Drop Multiple File Upload - Contact Form 7 plugin to the latest available version greater than 1.3.9.7 from the WordPress plugin repository and verify the installed version after upgrade (advisory: https://patchstack.com/database/wordpress/plugin/drag-and-drop-multiple-file-upload-contact-form-7/vulnerability/wordpress-drag-and-drop-multiple-file-upload-contact-form-7-plugin-1-3-9-7-cross-site-scripting-xss-vulnerability). If immediate upgrade is not possible, compensating controls include deactivating the plugin on affected sites (trade-off: removes drag-and-drop upload functionality from Contact Form 7 forms), placing a WAF rule in front of WordPress to block requests containing script tags or common XSS payloads in upload-related parameters (trade-off: may produce false positives on legitimate filenames), and restricting which roles can access form-submission review screens to limit administrator exposure to malicious payloads.