Skip to content
OpenAdvisories
High · 7.1 CVE-2026-49055 EUVD-2026-36868GHSA-6wvr-3ch8-8c9p

WordPress Drag and Drop Multiple File Upload – Contact Form 7 plugin <= 1.3.9.7 - Cross Site Scripting (XSS) vulnerability

Published Jun 15, 2026 · Updated Jun 16, 2026 · Assigned by Patchstack

Vendor: Glen Don Mongaya Product: Drag and Drop Multiple File Upload – Contact Form 7

Description

Unauthenticated Cross Site Scripting (XSS) in Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.9.7 versions.

Affected products

VendorProductAffectedFixed
Glen Don Mongaya Drag and Drop Multiple File Upload – Contact Form 7 ≤ 1.3.9.7 —

References