CVE-2026-49055: WordPress Drag and Drop Multiple File Upload – Contact Form 7 plugin <= 1.3.9.7 - Cross Site Scripting (XSS) vulnerability

Synopsis

A reflected or stored cross-site scripting (XSS) vulnerability affects the Drag and Drop Multiple File Upload plugin for Contact Form 7, versions 1.3.9.7 and earlier. The vulnerability is reachable over the network with no authentication required, but a victim must interact with a crafted link or form input to trigger the payload. Successful exploitation lets an attacker execute arbitrary JavaScript in the victim's browser, enabling session theft, page content manipulation, or unwanted actions performed on the victim's behalf. No upstream fix has been published yet; HarborGuard tracks the advisory and will surface patch availability as soon as one is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The plugin endpoint is exposed over the network, so an attacker must be able to reach the target web server from the internet or an accessible network path.

• AuthenticationNot required

  No account or credentials are needed; the attacker can trigger the vulnerable code path as an unauthenticated visitor.

• Victim interactionRequired

  A victim must interact with a crafted link or malicious input (for example, clicking a specially constructed URL or submitting a manipulated form), giving this a social-engineering component.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or unusual environmental configuration.

Blast Radius

• An attacker can execute arbitrary JavaScript in the victim's browser session, reading stored cookies and session tokens associated with the WordPress site.
• Injected script can modify the visible page content the victim sees, enabling phishing or credential-harvesting within the legitimate site context.
• The attacker can perform authenticated actions on the victim's behalf (such as changing account settings or submitting forms) if the victim holds an active session.
• Impact spans confidentiality, integrity, and availability at a low-to-moderate level per the CVSS scoring, affecting the victim's session data and the integrity of page content they interact with.