CVE-2026-49055

HIGH

WordPress Drag and Drop Multiple File Upload – Contact Form 7 plugin <= 1.3.9.7 - Cross Site Scripting (XSS) vulnerability

Title source: cna

Unauthenticated Cross Site Scripting (XSS) in Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.9.7 versions.

Core 1

Core References

Vdb Entry vdb-entry

CVSS v3 7.1

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CWE

CWE-79

Status published

Products (1)

Glen Don Mongaya/Drag and Drop Multiple File Upload – Contact Form 7 < 1.3.9.7

Published Jun 15, 2026

Tracked Since Jun 16, 2026