CVE-2026-8991 is a stored cross-site scripting vulnerability (CWE-79) in the Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress. The flaw exists in the handling of the 'drag_n_drop_text' and 'drag_n_drop_browse_text' settings, where insufficient sanitization and escaping allow administrator-level authenticated attackers to inject arbitrary web scripts. These scripts execute in the context of users who access the injected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to 1.3.9.7. The CVSS 3.1 base score is 4.4, reflecting medium severity with network attack vector, high attack complexity, and required privileges.

An authenticated attacker with administrator or higher privileges can inject malicious scripts into plugin settings that are stored and later executed in the context of users viewing the affected pages. This can lead to unauthorized actions performed on behalf of users or theft of sensitive information accessible via the browser. The impact is limited by the requirement for high privileges and no user interaction is required beyond viewing the injected page.

No official patch or remediation guidance is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict administrator-level access to trusted users only and consider disabling or removing the vulnerable plugin if possible to prevent exploitation.