The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin prior to version 1.3.9.9 contains a CWE-79 Cross-Site Scripting vulnerability. Specifically, it fails to escape a setting before using it as an HTML tag name in the front-end output. This vulnerability enables users with administrator access to inject arbitrary scripts that execute in the context of any front-end page rendering the affected upload field, potentially leading to script execution attacks.

An attacker with administrator access can exploit this vulnerability to inject and execute arbitrary scripts on front-end pages that render the upload field. This could lead to session hijacking, defacement, or other script-based attacks within the context of the affected site. However, exploitation requires administrator privileges, limiting the scope of impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to the upload field. Avoid using affected versions in production environments if possible.