https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-06T20:35:00.468926+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-14325 fkie_cve-2026-14325 2026-10-06T20:35:00.499723+00:00

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using it as an HTML tag name in front-end output, allowing users with administrator access to inject arbitrary web scripts that execute on any front-end page rendering its upload field.

 https://vulnerability.circl.lu/vuln/ghsa-42hj-5w59-p3r2 GHSA-42hj-5w59-p3r2 2026-10-06T20:35:00.499820+00:00

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using it as an HTML tag name in front-end output, allowing users with administrator access to inject arbitrary web scripts that execute on any front-end page rendering its upload field.