Unauthenticated Cross Site Scripting (XSS) in the Drag and Drop Multiple File Upload – Contact Form 7 plugin permits an attacker to inject malicious scripts into the user interface because user‑supplied content is not properly sanitized or encoded when displayed. This flaw is classified as CWE‑79 and could lead to session hijacking, defacement, or execution of arbitrary code in the victim’s browser.

WordPress sites that have installed the Drag and Drop Multiple File Upload – Contact Form 7 plugin from Glen Don Mongaya, version 1.3.9.7 or earlier, are vulnerable. The attack surface is the file‑upload form provided by the plugin.

The vulnerability has a CVSS score of 7.1, indicating moderate severity, and an EPSS score of <1%, suggesting a relatively low probability of exploitation in the wild. The bug is not listed in the CISA KEV catalog. An unauthenticated attacker can trigger the flaw by posting a crafted request to the file‑upload endpoint, which injects JavaScript into the page served to other visitors. Once executed in a victim’s browser, the script can perform a range of malicious actions that compromise the confidentiality and integrity of user data.