CVE-2026-14325

Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Admin+ Stored XSS via drag_n_drop_heading_tag Setting

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using it as an HTML tag name in front-end output, allowing users with administrator access to inject arbitrary web scripts that execute on any front-end page rendering its upload field.

We have discovered 18,162 live websites that are affected by CVE-2026-14325.

Run a Free Instant Scan



Affected Software

Product  Drag And Drop Multiple File Upload Contact Form 7
Category Wordpress Plugins
Vulnerable Domains18,162 live websites (100% of Drag And Drop Multiple File Upload Contact Form 7 install base)
Vulnerable Versions
  • from 0 through 1.3.9.9
Vulnerable Versions Count60 versions ( 100% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Aug 21, 2026
  • Updated - Aug 21, 2026

Credits

  • Sai Praneeth Koti (finder)
  • WPScan (coordinator)

Website Distribution by Country

Number of websites using CVE-2026-14325
United States3,301 websites


Germany3,676 websites
France962 websites
Japan891 websites
GB833 websites
Russia756 websites
Poland701 websites
Italy664 websites
Netherlands573 websites
Spain454 websites

Website Distribution by TLD

Number of websites using CVE-2026-14325
.com5,392 websites
.de2,817 websites
.ru616 websites
.co.uk568 websites
.nl541 websites
.org533 websites
.it508 websites
.pl501 websites
.fr478 websites
.com.au372 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-14325

Top websites that are affected by CVE-2026-14325. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
********************.com United States**,***
******.cc Malaysia**,***
********.me United States**,***
****.hr Croatia**,***
******.pt Portugal**,***
****************.org United States**,***
*******.com Italy**,***
****.si Slovenia**,***
*******.org France**,***
**********************.**.uk GB**,***
See full domain list

FAQ

CVE-2026-14325 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Drag And Drop Multiple File Upload Contact Form 7
A total of 18,162 websites have been identified as vulnerable to CVE-2026-14325, based on global website indexing conducted by WebTechSurvey.
The Drag And Drop Multiple File Upload Contact Form 7 is affected by the CVE-2026-14325 vulnerability.
Drag And Drop Multiple File Upload Contact Form 7 versions up to 1.3.9.9 are vulnerable to CVE-2026-14325.
CVE-2026-14325 is resolved in version 1.3.9.9 of Drag And Drop Multiple File Upload Contact Form 7.