CVE-2026-14325: Contact Form 7 File Upload XSS Vulnerability

CVE-2026-14325 Overview

CVE-2026-14325 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin. Versions before 1.3.9.9 fail to escape one of the plugin settings before using it as an HTML tag name in front-end output. An authenticated administrator can inject arbitrary JavaScript that executes on any front-end page rendering the plugin's upload field. Exploitation requires administrator privileges and user interaction, which limits practical impact in single-admin WordPress deployments but remains relevant in multi-administrator environments and hosting scenarios with segregated trust boundaries.

Critical Impact
An authenticated administrator can persist arbitrary JavaScript into plugin settings, causing script execution for every visitor who loads a page containing the plugin's upload field.

Affected Products

Drag and Drop Multiple File Upload for Contact Form 7 (WordPress plugin)
Versions prior to 1.3.9.9
WordPress sites rendering the plugin's upload field on front-end pages

Discovery Timeline

2026-08-21 - CVE-2026-14325 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-14325

Vulnerability Analysis

The vulnerability resides in the plugin's front-end rendering logic. The plugin reads an administrator-controlled setting and inserts the value directly into HTML output as a tag name without escaping or validation. Because the value is used to construct an HTML element, standard attribute-context escaping would not fully neutralize the payload; the injection point allows an attacker to break out of the intended tag structure and introduce arbitrary markup, including <script> blocks or event handlers.

The stored payload persists in the WordPress options store and executes on every front-end page rendering the upload field. This makes the flaw a persistent XSS rather than a reflected variant, expanding the exploitation window to every visitor loading affected pages.

Root Cause

The root cause is missing output escaping on a settings value that is concatenated into an HTML tag name. WordPress provides helpers such as esc_html(), esc_attr(), and tag_escape() for these contexts, but the plugin's affected code path does not apply them before emitting the value.

Attack Vector

An attacker with administrator access to the WordPress admin panel modifies the vulnerable plugin setting and stores a JavaScript payload. When a visitor loads any front-end page that renders the plugin's upload field, the browser executes the stored script in the site's origin. Consequences include session token theft, forced administrative actions via CSRF chaining, redirection to attacker-controlled infrastructure, and injection of cryptocurrency miners or malicious redirectors. The trust boundary in scope here is the site owner or lower-privileged administrators being targeted by a rogue or compromised administrator account.

No verified proof-of-concept code has been published. The WPScan Vulnerability Report contains additional technical detail on the affected setting.

Detection Methods for CVE-2026-14325

Indicators of Compromise

Unexpected <script> tags, inline event handlers, or obfuscated JavaScript in the Drag and Drop Multiple File Upload plugin's settings stored in the wp_options table.
Front-end HTML containing malformed or unusual tag names in the region rendering the plugin's upload field.
Outbound requests from site visitors to unfamiliar domains initiated only when pages containing the upload field are loaded.

Detection Strategies

Audit wp_options entries associated with the plugin for HTML control characters (<, >, ", ', =) in fields expected to hold simple identifiers.
Deploy a web application firewall rule that flags administrator POST requests to admin.php or options.php containing script fragments in plugin settings.
Review WordPress audit logs for administrator setting changes to the affected plugin, correlated with subsequent front-end content changes.

Monitoring Recommendations

Enable a WordPress activity log plugin to record all settings changes with administrator attribution and timestamps.
Monitor browser Content Security Policy (CSP) violation reports for inline script executions originating from pages hosting Contact Form 7 forms.
Track plugin version inventory across managed WordPress instances and alert on installations below 1.3.9.9.

How to Mitigate CVE-2026-14325

Immediate Actions Required

Update the Drag and Drop Multiple File Upload for Contact Form 7 plugin to version 1.3.9.9 or later on every WordPress instance.
Review the plugin's stored settings and remove any values containing HTML or JavaScript syntax.
Rotate administrator credentials and session tokens if unauthorized setting changes are found.

Patch Information

The plugin author addressed the missing output escaping in version 1.3.9.9. Site owners should apply the update through the WordPress plugin dashboard or via wp-cli using wp plugin update drag-and-drop-multiple-file-upload-contact-form-7. Confirm the installed version through the Plugins page after update.

Workarounds

Restrict administrator access to trusted personnel and enforce multi-factor authentication on all administrative accounts.
Deploy a Content Security Policy that disallows inline scripts on front-end pages to blunt script execution from stored payloads.
Temporarily disable the plugin on public-facing pages if immediate patching is not feasible.

bash

# Update the plugin using wp-cli
wp plugin update drag-and-drop-multiple-file-upload-contact-form-7

# Verify installed version
wp plugin get drag-and-drop-multiple-file-upload-contact-form-7 --field=version