PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-49055 Glen Don Mongaya CVE debrief

CVE-2026-49055 is a high-severity unauthenticated Cross Site Scripting (XSS) vulnerability in the Drag and Drop Multiple File Upload – Contact Form 7 plugin versions up to 1.3.9.7. Defenders should assess exposure, prioritize remediation, and verify inventory for this plugin. The CVE record was published on 2026-06-15T21:17:18.840Z and was last modified on 2026-10-25T23:10:00.167Z. The NVD entry is currently Deferred.

Vendor
Glen Don Mongaya
Product
Drag and Drop Multiple File Upload – Contact Form 7
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-15
Original CVE updated
2026-10-25
Advisory published
2026-06-15
Advisory updated
2026-10-25

Who should care

Defenders, security teams, and WordPress administrators who use the Drag and Drop Multiple File Upload – Contact Form 7 plugin should assess exposure and prioritize remediation.

Why it matters

CVE-2026-49055 is a high-severity unauthenticated XSS vulnerability in the Drag and Drop Multiple File Upload – Contact Form 7 plugin. Defenders should assess exposure, prioritize remediation, and verify inventory for this plugin. The CVE record was published on 2026-06-15T21:17:18.840Z and was last modified on 2026-10-25T23:10:00.167Z.

  • Defenders should verify inventory for the Drag and Drop Multiple File Upload – Contact Form 7 plugin to assess exposure.
  • Remediation of vulnerable versions (up to 1.3.9.7) is necessary to prevent potential XSS attacks.
  • Monitoring for potential exploitation attempts is recommended.
  • Details on exploitation, impact, and remediation require verification from official sources.

Technical summary

CVE-2026-49055 is a high-severity unauthenticated Cross Site Scripting (XSS) vulnerability in the Drag and Drop Multiple File Upload – Contact Form 7 plugin versions up to 1.3.9.7. The vulnerability has a CVSS score of 7.1 and is classified as HIGH. The CVE record and NVD detail page provide official vulnerability metadata.

Defensive priority

Defenders should prioritize verifying inventory for the Drag and Drop Multiple File Upload – Contact Form 7 plugin, assessing exposure to unauthenticated XSS attacks, and remediating vulnerable versions.

Recommended defensive actions

  • Verify inventory for the Drag and Drop Multiple File Upload – Contact Form 7 plugin
  • Assess exposure to unauthenticated XSS attacks
  • Remediate vulnerable versions (up to 1.3.9.7)
  • Monitor for potential exploitation attempts

Evidence notes

The CVE record and NVD detail page provide official vulnerability metadata. Patchstack reported the vulnerability with a detailed description. However, details on exploitation, impact, and remediation require verification from official sources.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-49055 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-49055

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-49055 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-49055

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.