Is CVE-2026-14325 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14325 being exploited in the wild.

How severe is CVE-2026-14325?

Low severity, with a CVSS score of 3.5, published 21 August 2026.

Which products and versions are affected?

Drag and Drop Multiple File Upload for Contact Form 7 contributors Drag and Drop Multiple File Upload for Contact Form 7 before 1.3.9.9.

Is there a fix for CVE-2026-14325?

A patch was published on 2026-08-21: Version 1.3.9.9 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-14325 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-14325?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14325: Drag and Drop Multiple File Upload for Contact Form 7 stored XSS in heading tag setting

CVE-2026-14325 · Severity: low · CVSS 3.5 · Published 2026-08-21

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin allows administrators to customize upload field display through settings. A flaw in how one setting (the heading tag) is processed and rendered permits administrators to inject arbitrary JavaScript code that executes for all visitors viewing pages with the upload form, compromising the security of front-end pages.

Quick answers

Is CVE-2026-14325 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14325 being exploited in the wild.
How severe is CVE-2026-14325?: Low severity, with a CVSS score of 3.5, published 21 August 2026.
Which products and versions are affected?: Drag and Drop Multiple File Upload for Contact Form 7 contributors Drag and Drop Multiple File Upload for Contact Form 7 before 1.3.9.9.
Is there a fix for CVE-2026-14325?: A patch was published on 2026-08-21: Version 1.3.9.9 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-14325 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-14325?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a stored XSS vulnerability (CWE-79) in the drag_n_drop_heading_tag setting. The plugin accepts user input via this setting but fails to validate it against an allowlist (h1-h6, span, div); instead, only applying sanitize_text_field() which does not strip HTML-unsafe characters like spaces and equals signs used in attribute injection. When rendering the upload field, the stored value is inserted directly into an HTML tag name via insertAdjacentHTML(), allowing payloads such as "img src=x onerror=alert()" to execute JavaScript. The vulnerability requires administrator privileges to inject the payload via plugin settings, but any front-end visitor (including unauthenticated users) will execute the injected script when viewing a page with a Contact Form 7 form containing the [mfile] drag-and-drop field. The issue was fixed in version 1.3.9.9 by enforcing proper input validation.

Affected products

Drag and Drop Multiple File Upload for Contact Form 7 contributors Drag and Drop Multiple File Upload for Contact Form 7 before 1.3.9.9

Timeline

2026-08-19: disclosed
2026-08-21: patched: Version 1.3.9.9 released
2026-08-21: advisory

References

https://wpscan.com/vulnerability/fc723849-62d3-4c87-a0ad-5e5354961303/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.