Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 – Admin+ Stored XSS via drag_n_drop_heading_tag Setting | CVE 2026-14325

Description

The plugin does not escape one of its settings before using it as an HTML tag name in front-end output, allowing users with administrator access to inject arbitrary web scripts that execute on any front-end page rendering its upload field.

Proof of Concept

Prerequisite: at least one public page renders a Contact Form 7 form containing a drag-and-drop
[mfile] field, which is the plugin's normal use case.

STEP 1 - As an administrator, open the plugin settings at

    https://victim.example/wp-admin/admin.php?page=drag-n-drop-upload

and set the "Heading Tag" setting to:

    img src=x onerror=alert(document.domain)

Save. The value has no angle brackets, so it survives sanitize_text_field, and the sanitize
callback does not enforce the h1-h6/span/div allowlist that the select offers.

STEP 2 - Log out, then open the public page carrying the [mfile] field as an anonymous visitor:

    GET https://victim.example/upload-page/

The stored value is served into the page as the uploader's tag name, and the uploader script
builds <TAG>...</TAG> from it and inserts it with insertAdjacentHTML(), producing a live
element:

    <img src=x onerror=alert(document.domain)>

Expected result: the failed src=x load fires onerror and the script executes in the visitor's
browser, in the site origin. It fires for every anonymous visitor of such a page, not only for
the administrator who saved the setting.

On 1.3.9.9 the same save stores h3 and the page renders h3 with nothing executing.