Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-06-17
Drag and Drop Multiple File Upload - Arbitrary File Upload (CVE-2026-49055)
Unauthenticated Cross Site Scripting (XSS) in Drag and Drop Multiple File Upload – Contact Form 7
PLUGIN
Drag and Drop Multiple File Upload
CVE-2026-49055
Risk Score
Threat Entry
Updated 2026-06-17
Drag And Drop Multiple File Upload - Remote Code Execution (CVE-2026-3459)
The Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'dnd_upload_cf7_upload' function in versions up to, and including, 1.3.7.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. This can be exploited if the form includes a multiple file upload field with ‘*’ as the accepted file type.
PLUGIN
Drag And Drop Multiple File Upload
CVE-2026-3459
Risk Score
Threat Entry
Updated 2026-06-17
Drag and Drop Multiple File Upload - Remote Code Execution (CVE-2025-14842)
The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to limited upload of files with a dangerous type in all versions up to, and including, 1.3.9.2. This is due to the plugin not blocking .phar and .svg files. This makes it possible for unauthenticated attackers to upload arbitrary .phar or .svg files containing malicious PHP or JavaScript code. Malicious PHP code can be used to achieve remote code execution on the server via direct file access, if the server is configured to execute…
PLUGIN
Drag and Drop Multiple File Upload
CVE-2025-14842
Risk Score
Threat Entry
Updated 2026-06-17
Drag And Drop Multiple File Upload - Remote Code Execution (CVE-2025-5746)
The Drag and Drop Multiple File Upload (Pro) - WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the dnd_upload_cf7_upload_chunks() function in version 5.0 - 5.0.5 (when bundled with the PrintSpace theme) and all versions up to, and including, 1.7.1 (in the standalone version). This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. The execution of PHP is disabled via a .htaccess file but is still possible in…
PLUGIN
Drag And Drop Multiple File Upload
CVE-2025-5746
Risk Score
Threat Entry
Updated 2026-06-17
Drag And Drop Multiple File Upload - Remote Code Execution (CVE-2024-12267)
The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to limited arbitrary file deletion due to insufficient file path validation in the dnd_codedropz_upload_delete() function in all versions up to, and including, 1.3.8.5. This makes it possible for unauthenticated attackers to delete limited arbitrary files on the server. It is not possible to delete files like wp-config.php that would make RCE possible.
PLUGIN
Drag And Drop Multiple File Upload
CVE-2024-12267
Risk Score
Threat Entry
Updated 2026-06-17
Drag And Drop Multiple File Upload - Arbitrary File Upload (CVE-2024-3717)
The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.7.7 via the '/wp-content/uploads/wp_dndcf7_uploads/wpcf7-files' directory. This makes it possible for unauthenticated attackers to extract sensitive data uploaded via this plugin through a form.
PLUGIN
Drag And Drop Multiple File Upload
CVE-2024-3717
Risk Score
Threat Entry
Updated 2026-06-17
Drag And Drop Multiple File Upload - Remote Code Execution (CVE-2023-5822)
The Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'dnd_upload_cf7_upload' function in versions up to, and including, 1.3.7.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. This can be exploited if a user authorized to edit form, which means editor privileges or above, has added a 'multiple file upload' form field with '*' acceptable file types.
PLUGIN
Drag And Drop Multiple File Upload
CVE-2023-5822
Risk Score
Threat Entry
Updated 2026-06-17
Drag and Drop Multiple File Upload - Arbitrary File Upload (CVE-2022-3282)
The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.5 does not properly check for the upload size limit set in forms, taking the value from user input sent when submitting the form. As a result, attackers could control the file length limit and bypass the limit set by admins in the contact form.
PLUGIN
Drag and Drop Multiple File Upload
CVE-2022-3282
Risk Score
Threat Entry
Updated 2026-06-17
Drag and Drop Multiple File Upload - Arbitrary File Upload (CVE-2022-0595)
The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.3 allows SVG files to be uploaded by default via the dnd_codedropz_upload AJAX action, which could lead to Stored Cross-Site Scripting issue
PLUGIN
Drag and Drop Multiple File Upload
CVE-2022-0595
Risk Score