Executive brief
The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin allows administrators to customize upload field display through settings. A flaw in how one setting (the heading tag) is processed and rendered permits administrators to inject arbitrary JavaScript code that executes for all visitors viewing pages with the upload form, compromising the security of front-end pages.
Technical details
This is a stored XSS vulnerability (CWE-79) in the drag_n_drop_heading_tag setting. The plugin accepts user input via this setting but fails to validate it against an allowlist (h1-h6, span, div); instead, only applying sanitize_text_field() which does not strip HTML-unsafe characters like spaces and equals signs used in attribute injection. When rendering the upload field, the stored value is inserted directly into an HTML tag name via insertAdjacentHTML(), allowing payloads such as "img src=x onerror=alert()" to execute JavaScript. The vulnerability requires administrator privileges to inject the payload via plugin settings, but any front-end visitor (including unauthenticated users) will execute the injected script when viewing a page with a Contact Form 7 form containing the [mfile] drag-and-drop field. The issue was fixed in version 1.3.9.9 by enforcing proper input validation.
Affected products
- Drag and Drop Multiple File Upload for Contact Form 7 contributors Drag and Drop Multiple File Upload for Contact Form 7 before 1.3.9.9
Timeline
- 2026-08-19: disclosed
- 2026-08-21: patched: Version 1.3.9.9 released
- 2026-08-21: advisory