CVE-2026-8991 is a stored cross-site scripting vulnerability in the Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress, affecting all versions up to and including 1.3.9.7. The issue arises from improper neutralization of input in the 'drag_n_drop_text' and 'drag_n_drop_browse_text' settings, allowing authenticated administrators to inject arbitrary web scripts. These scripts execute in the context of users who access the injected pages, potentially leading to information disclosure or session hijacking. The vulnerability requires high privileges (administrator) and does not involve user interaction beyond viewing the affected page.

An attacker with administrator-level access can inject malicious scripts into plugin settings that are stored and later executed in the browsers of users who visit the affected pages. This can lead to limited confidentiality and integrity impacts such as theft of user credentials or manipulation of page content. The attack does not affect availability. The vulnerability requires high privileges to exploit and does not involve user interaction beyond page access.

No official patch or fix has been confirmed or published by the vendor as of the provided data. Users should monitor the vendor advisory for updates on remediation. Until a fix is available, restrict administrator access to trusted users only and consider disabling or removing the plugin if possible to mitigate risk.