Junglewise Threat Intelligence

CVE-2026-8991: CodeDropz Drag and Drop Multiple File Upload Stored XSS in Settings

CVE-2026-8991 · Severity: medium · CVSS 4.4 · Published 2026-06-06

Technologies: CodeDropz Drag and Drop Multiple File Upload for Contact Form 7.

Executive brief

A WordPress plugin used for adding file upload capabilities to contact forms is vulnerable to a security flaw that allows administrators to embed malicious scripts into the website. These scripts can execute in the browsers of other users, including site visitors and other staff, potentially leading to unauthorized actions or data theft. This issue stems from how the plugin handles custom text settings for the file upload interface.

Technical details

The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress (versions up to 1.3.9.7) is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'drag_n_drop_text' and 'drag_n_drop_browse_text' settings. An authenticated attacker with administrator-level privileges can inject arbitrary web scripts into these fields. These scripts are then stored and executed in the context of any user's browser who visits the affected pages. While the attack requires high privileges, the impact is elevated because the script can execute in the context of other users (Scope: Changed). A patch appears to be available in versions following 1.3.9.7.

Affected products

  • CodeDropz Drag and Drop Multiple File Upload for Contact Form 7 up to, and including, 1.3.9.7

Timeline

  • 2026-06-06: disclosed
  • 2026-06-06: advisory

References