Unknown Drag and Drop Multiple File Upload for Contact Form 7

• CVE-2026-18781 High 8.1 Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Unauthenticated RCE via Control Character Filename Bypass 0.5%
• CVE-2026-14325 Low 3.5 Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Admin+ Stored XSS via drag_n_drop_heading_tag Setting 0.2%