CVE-2026-14325: Unknown Drag And Drop Multiple File Upload For Contact Form 7

Low severity, CVSS 3.5. EPSS: 0.2% chance of exploitation in the next 30 days.

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using it as an HTML tag name in front-end output, allowing users with administrator access to inject arbitrary web scripts that execute on any front-end page rendering its upload field.

Affected products

• Unknown Drag And Drop Multiple File Upload For Contact Form 7: before 1.3.9.9 (fixed in 1.3.9.9)

Published 2026-08-21. Last modified 2026-08-26.