Is CVE-2026-8991 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8991 being exploited in the wild.

How severe is CVE-2026-8991?

Medium severity, with a CVSS score of 4.4, published 6 June 2026.

Which products and versions are affected?

CodeDropz Drag and Drop Multiple File Upload for Contact Form 7 up to, and including, 1.3.9.7.

Is there a fix for CVE-2026-8991?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-8991 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-8991?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8991: CodeDropz Drag and Drop Multiple File Upload Stored XSS in Settings

CVE-2026-8991 · Severity: medium · CVSS 4.4 · Published 2026-06-06

A WordPress plugin used for adding file upload capabilities to contact forms is vulnerable to a security flaw that allows administrators to embed malicious scripts into the website. These scripts can execute in the browsers of other users, including site visitors and other staff, potentially leading to unauthorized actions or data theft. This issue stems from how the plugin handles custom text settings for the file upload interface.

Quick answers

Is CVE-2026-8991 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8991 being exploited in the wild.
How severe is CVE-2026-8991?: Medium severity, with a CVSS score of 4.4, published 6 June 2026.
Which products and versions are affected?: CodeDropz Drag and Drop Multiple File Upload for Contact Form 7 up to, and including, 1.3.9.7.
Is there a fix for CVE-2026-8991?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-8991 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-8991?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress (versions up to 1.3.9.7) is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'drag_n_drop_text' and 'drag_n_drop_browse_text' settings. An authenticated attacker with administrator-level privileges can inject arbitrary web scripts into these fields. These scripts are then stored and executed in the context of any user's browser who visits the affected pages. While the attack requires high privileges, the impact is elevated because the script can execute in the context of other users (Scope: Changed). A patch appears to be available in versions following 1.3.9.7.

Affected products

CodeDropz Drag and Drop Multiple File Upload for Contact Form 7 up to, and including, 1.3.9.7

Timeline

2026-06-06: disclosed
2026-06-06: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.