Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

32 results

Aug 21, 2026Drag and Drop Multiple File Upload for Contact Form 7: Does not validate the final name of an uploaded file after stripping characters from itCVE-2026-18781 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not validate the final name of an uploaded file after stripping characters from it, allowing unauthenticated users to defeat its file type restrictions and execute arbitrary code on the server.
Product
Drag and Drop Multiple File Upload for Contact Form 7
Fixed in
1.3.9.9
What to do
Update Drag and Drop Multiple File Upload for Contact Form 7 to 1.3.9.9 or newer.
Full record and what to do →NVD record wpscan.com
Aug 21, 2026Drag and Drop Multiple File Upload for Contact Form 7: Does not escape one of its settings before using itCVE-2026-14325 · WordPress plugins & themes · reported by WPScanLow 3.5
The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using it as an HTML tag name in front-end output, allowing users with administrator access to inject arbitrary web scripts that execute on any front-end page rendering its upload field.
Product
Drag and Drop Multiple File Upload for Contact Form 7
Fixed in
1.3.9.9
What to do
Update Drag and Drop Multiple File Upload for Contact Form 7 to 1.3.9.9 or newer.
Full record and what to do →NVD record wpscan.com
Aug 6, 2026Drag and Drop Multiple File Upload for WooCommerce: Does not prevent unauthenticated users from obtaining a valid nonce that is the only control gating its file-deletion routineCVE-2026-16054 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.8 does not prevent unauthenticated users from obtaining a valid nonce that is the only control gating its file-deletion routine, allowing anonymous attackers to delete files staged in its upload directory and irreversibly destroy customers' pending order attachments.
Product
Drag and Drop Multiple File Upload for WooCommerce
Fixed in
1.1.8
What to do
Update Drag and Drop Multiple File Upload for WooCommerce to 1.1.8 or newer.
Full record and what to do →NVD record wpscan.com
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.9.7 versions.CVE-2026-49055 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.9.7 versions.
Affected
up to 1.3.9.7
What to do
Affects up to 1.3.9.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2026Drag and Drop Multiple File Upload for Contact Form 7: Stored Cross-Site ScriptingCVE-2026-8991 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'drag_n_drop_text' and 'drag_n_drop_browse_text' Settings in all versions up to, and including, 1.3.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Drag and Drop Multiple File Upload for Contact Form 7
Affected
up to 1.3.9.7
What to do
Affects up to 1.3.9.7. Update Drag and Drop Multiple File Upload for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 17, 2026Drag and Drop Multiple File Upload for Contact Form 7: Arbitrary file uploadCVE-2026-5718 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file upload in versions up to, and including, 1.3.9.7. This is due to insufficient file type validation that occurs when custom blacklist types are configured, which replaces the default dangerous extension denylist instead of merging with it, and the wpcf7_antiscript_file_name() sanitization function being bypassed for filenames containing non-ASCII characters. This makes it possible for unauthenticated attackers to upload arbitrary files, such as PHP files, to the server, which can be leveraged to achieve remote code execution. The vulnerability was originally reported by Leonid Semenenko (lsemenenko) and partially patched in version 1.3.9.7. A bypass for the patch was separately discovered and reported by Nguyen Hung (Mitchell).
Product
Drag and Drop Multiple File Upload for Contact Form 7
Affected
up to 1.3.9.7
What to do
Affects up to 1.3.9.7. Update Drag and Drop Multiple File Upload for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 17, 2026Drag and Drop Multiple File Upload for Contact Form 7: Path Traversal leading to Arbitrary File ReadCVE-2026-5710 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to Path Traversal leading to Arbitrary File Read in versions up to and including 1.3.9.6. This is due to the plugin using client-supplied mfile[] POST values as the source of truth for email attachment selection without performing any server-side upload provenance check, path canonicalization, or directory containment boundary enforcement. In dnd_wpcf7_posted_data(), each user-submitted filename is directly appended to the plugin's upload URL without sanitization. In dnd_cf7_mail_components(), the URL is converted back to a filesystem path using str_replace() and only file_exists() is used as the acceptance check before attaching the file to the outgoing CF7 email. This makes it possible for unauthenticated attackers to read and exfiltrate arbitrary files readable by the web server process via path traversal sequences in the mfile[] parameter, with files being disclosed as email attachments. Note: This vulnerability is limited to the 'wp-content' folder due to the wpcf7_is_file_path_in_content_dir() function in the Contact Form 7 plugin.
Product
Drag and Drop Multiple File Upload for Contact Form 7
Affected
up to 1.3.9.6
What to do
Affects up to 1.3.9.6. Update Drag and Drop Multiple File Upload for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 5, 2026Drag and Drop Multiple File Upload - Contact Form 7: Arbitrary file uploadsCVE-2026-3459 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'dnd_upload_cf7_upload' function in versions up to, and including, 1.3.7.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. This can be exploited if the form includes a multiple file upload field with ‘*’ as the accepted file type.
Product
Drag and Drop Multiple File Upload - Contact Form 7
Affected
up to 1.3.7.3
What to do
Affects up to 1.3.7.3. Update Drag and Drop Multiple File Upload - Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 15, 2026Drag and Drop Multiple File Upload for Contact Form 7: Unauthorized modification of dataCVE-2025-14457 · WordPress plugins & themes · reported by WordfenceLow 3.7
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ownership check in the dnd_codedropz_upload_delete() function in all versions up to, and including, 1.3.9.2. This makes it possible for unauthenticated attackers to delete arbitrary uploaded files when the "Send attachments as links" setting is enabled.
Product
Drag and Drop Multiple File Upload for Contact Form 7
Affected
up to 1.3.9.2
What to do
Affects up to 1.3.9.2. Update Drag and Drop Multiple File Upload for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2026Drag and Drop Multiple File Upload – Contact Form 7: Limited upload of files with a dangerous typeCVE-2025-14842 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to limited upload of files with a dangerous type in all versions up to, and including, 1.3.9.2. This is due to the plugin not blocking .phar and .svg files. This makes it possible for unauthenticated attackers to upload arbitrary .phar or .svg files containing malicious PHP or JavaScript code. Malicious PHP code can be used to achieve remote code execution on the server via direct file access, if the server is configured to execute .phar files as PHP. The upload of .svg files allows for Stored Cross-Site Scripting under certain circumstances.
Product
Drag and Drop Multiple File Upload – Contact Form 7
Affected
up to 1.3.9.2
What to do
Affects up to 1.3.9.2. Update Drag and Drop Multiple File Upload – Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 25, 2025Webform Multiple File Upload module for Drupal 7.x contains a cross-site scripting (XSS) vulnerability in the file name renderer.CVE-2025-12848 · Websites & servers · reported by mlhess@drupal.orgHigh 7
Webform Multiple File Upload module for Drupal 7.x contains a cross-site scripting (XSS) vulnerability in the file name renderer. An unauthenticated attacker can exploit this vulnerability by uploading a file with a malicious filename containing JavaScript code (e.g., "<img src=1 onerror=alert(document.domain)>") to a Webform node with a Multifile field where file type validation is disabled. This allows the execution of arbitrary scripts in the context of the victim's browser. The issue is present in a third-party library and has been addressed in a patch available at https://github.com/fyneworks/multifile/pull/44 . Users are advised to apply the provided patch or update to a fixed version of the module.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record d7es.tag1.com d7security.org
Aug 16, 2025Drag and Drop Multiple File Upload for Contact Form 7: Directory TraversalCVE-2025-8464 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.9.0 via the wpcf7_guest_user_id cookie. This makes it possible for unauthenticated attackers to upload and delete files outside of the originally intended directory. The impact of this vulnerability is limited, as file types are validated and only safe ones can be uploaded, while deletion is limited to the plugin's uploads folder.
Product
Drag and Drop Multiple File Upload for Contact Form 7
Affected
up to 1.3.9.0
What to do
Affects up to 1.3.9.0. Update Drag and Drop Multiple File Upload for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 2, 2025Drag and Drop Multiple File Upload (Pro) - WooCommerce: Arbitrary file uploadsCVE-2025-5746 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Drag and Drop Multiple File Upload (Pro) - WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the dnd_upload_cf7_upload_chunks() function in version 5.0 - 5.0.5 (when bundled with the PrintSpace theme) and all versions up to, and including, 1.7.1 (in the standalone version). This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. The execution of PHP is disabled via a .htaccess file but is still possible in certain server configurations. CVE-2025-49885 may be a duplicate of this.
Product
Drag and Drop Multiple File Upload (Pro) - WooCommerce
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update Drag and Drop Multiple File Upload (Pro) - WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codedropz.com wordfence.com
Jun 27, 2025Drag and Drop Multiple File Upload (Pro) - WooCommerce: Unrestricted Upload of File with Dangerous TypeCVE-2025-49885 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in HaruTheme Drag and Drop Multiple File Upload (Pro) - WooCommerce drag-and-drop-file-upload-wc-pro allows Upload a Web Shell to a Web Server.This issue affects Drag and Drop Multiple File Upload (Pro) - WooCommerce: from n/a through <= 5.0.6.
Product
Drag and Drop Multiple File Upload (Pro) - WooCommerce
Affected
up to 5.0.6
What to do
Affects up to 5.0.6. Update Drag and Drop Multiple File Upload (Pro) - WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025Drag and Drop Multiple File Upload for Contact Form 7: Arbitrary file uploadsCVE-2025-3515 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 1.3.8.9. This makes it possible for unauthenticated attackers to bypass the plugin's blacklist and upload .phar or other dangerous file types on the affected site's server, which may make remote code execution possible on the servers that are configured to handle .phar files as executable PHP scripts, particularly in default Apache+mod_php configurations where the file extension is not strictly validated before being passed to the PHP interpreter.
Product
Drag and Drop Multiple File Upload for Contact Form 7
Affected
up to 1.3.8.9
What to do
Affects up to 1.3.8.9. Update Drag and Drop Multiple File Upload for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 9, 2025Drag and Drop Multiple File Upload for WooCommerce: Arbitrary file uploadsCVE-2025-4403 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.1.6 due to accepting a user‐supplied supported_type string and the uploaded filename without enforcing real extension or MIME checks within the upload() function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Drag and Drop Multiple File Upload for WooCommerce
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update Drag and Drop Multiple File Upload for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 5, 2025The Multiple File Upload add-on component 3.1.0 for OutSystems is vulnerable to Unrestricted File Upload.CVE-2025-28168 · Other software · Multi Uploaders · reported by MITREMedium 6.4
The Multiple File Upload add-on component 3.1.0 for OutSystems is vulnerable to Unrestricted File Upload. This occurs because file extension and size validations are enforced solely on the client side. An attacker can intercept the upload request and modify a parameter to bypass extension restrictions and upload arbitrary files. NOTE: this is a third-party component that is not supplied or supported by OutSystems.
Product
Multiple File Upload
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com outsystems.com
Apr 5, 2025Drag and Drop Multiple File Upload for WooCommerce: Arbitrary file movingCVE-2025-2941 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation via the wc-upload-file[] parameter in all versions up to, and including, 1.1.4. This makes it possible for unauthenticated attackers to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php).
Product
Drag and Drop Multiple File Upload for WooCommerce
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Drag and Drop Multiple File Upload for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Mar 28, 2025Drag and Drop Multiple File Upload for Contact Form 7: PHP Object InjectionCVE-2025-2485 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.8.7 via deserialization of untrusted input from the 'dnd_upload_cf7_upload' function. This makes it possible for attackers to inject a PHP Object through a PHAR file. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. This vulnerability may be exploited by unauthenticated attackers when a form is present on the site with the file upload action. The Flamingo plugin must be installed and activated in order to exploit the vulnerability. The vulnerability was partially patched in version 1.3.8.8.
Product
Drag and Drop Multiple File Upload for Contact Form 7
Affected
up to 1.3.8.7
What to do
Affects up to 1.3.8.7. Update Drag and Drop Multiple File Upload for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 28, 2025Drag and Drop Multiple File Upload for Contact Form 7: Arbitrary file deletionCVE-2025-2328 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'dnd_remove_uploaded_files' function in all versions up to, and including, 1.3.8.7. This makes it possible for unauthenticated attackers to add arbitrary file paths (such as ../../../../wp-config.php) to uploaded files on the server, which can easily lead to remote code execution when an Administrator deletes the message. Exploiting this vulnerability requires the Flamingo plugin to be installed and activated.
Product
Drag and Drop Multiple File Upload for Contact Form 7
Affected
up to 1.3.8.7
What to do
Affects up to 1.3.8.7. Update Drag and Drop Multiple File Upload for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 20, 2025A Denial of Service (DoS) vulnerability exists in multiple file upload endpoints of parisneo/lollms-webui version V12 (Strawberry).CVE-2024-8736 · Other software · parisneo · reported by security@huntr.devMedium 6.5
A Denial of Service (DoS) vulnerability exists in multiple file upload endpoints of parisneo/lollms-webui version V12 (Strawberry). The vulnerability can be exploited remotely via Cross-Site Request Forgery (CSRF). Despite CSRF protection preventing file uploads, the application still processes multipart boundaries, leading to resource exhaustion. By appending additional characters to the multipart boundary, an attacker can cause the server to parse each byte of the boundary, ultimately leading to service unavailability. This vulnerability is present in the `/upload_avatar`, `/upload_app`, and `/upload_logo` endpoints.
Product
parisneo/lollms-webui
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record huntr.com huntr.com
Jan 31, 2025Drag and Drop Multiple File Upload – Contact Form 7: Limited arbitrary file deletionCVE-2024-12267 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to limited arbitrary file deletion due to insufficient file path validation in the dnd_codedropz_upload_delete() function in all versions up to, and including, 1.3.8.5. This makes it possible for unauthenticated attackers to delete limited arbitrary files on the server. It is not possible to delete files like wp-config.php that would make RCE possible.
Product
Drag and Drop Multiple File Upload – Contact Form 7
Affected
up to 1.3.8.5
What to do
Affects up to 1.3.8.5. Update Drag and Drop Multiple File Upload – Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024Drag and Drop Multiple File Upload – Contact Form 7: Sensitive Information ExposureCVE-2024-3717 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.7.7 via the '/wp-content/uploads/wp_dndcf7_uploads/wpcf7-files' directory. This makes it possible for unauthenticated attackers to extract sensitive data uploaded via this plugin through a form.
Product
Drag and Drop Multiple File Upload – Contact Form 7
Affected
up to 1.3.7.7
What to do
Affects up to 1.3.7.7. Update Drag and Drop Multiple File Upload – Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 21, 2023Drag and Drop Multiple File Upload for WooCommerce: Unrestricted Upload of File with Dangerous TypeCVE-2022-45377 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unrestricted Upload of File with Dangerous Type vulnerability in Glen Don L. Mongaya Drag and Drop Multiple File Upload for WooCommerce.This issue affects Drag and Drop Multiple File Upload for WooCommerce: from n/a through 1.0.8.
Product
Drag and Drop Multiple File Upload for WooCommerce
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Drag and Drop Multiple File Upload for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Drag and Drop Multiple File Upload - Contact Form 7: Arbitrary file uploadsCVE-2023-5822 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'dnd_upload_cf7_upload' function in versions up to, and including, 1.3.7.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. This can be exploited if a user authorized to edit form, which means editor privileges or above, has added a 'multiple file upload' form field with '*' acceptable file types.
Product
Drag and Drop Multiple File Upload - Contact Form 7
Affected
up to 1.3.7.3
What to do
Affects up to 1.3.7.3. Update Drag and Drop Multiple File Upload - Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2023Drag and Drop Multiple File Upload for WooCommerce: Does not filter all potentially dangerous file extensionsCVE-2023-4821 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.1 does not filter all potentially dangerous file extensions. Therefore, an attacker can upload unsafe .shtml or .svg files containing malicious scripts.
Product
Drag and Drop Multiple File Upload for WooCommerce
Fixed in
1.1.1
What to do
Update Drag and Drop Multiple File Upload for WooCommerce to 1.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 17, 2023Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard: And Drag and Drop Multiple File Upload PRO - Contact Form 7 with Remote Storage Integrations WordPress plugin before 5CVE-2023-1282 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard WordPress plugin before 2.11.1 and Drag and Drop Multiple File Upload PRO - Contact Form 7 with Remote Storage Integrations WordPress plugin before 5.0.6.4 do not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admins.
Product
Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard
Fixed in
2.11.1
What to do
Update Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard to 2.11.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 1, 2023A vulnerability was found in Drag and Drop Multiple File Upload Contact Form 7 5.0.6.1 on WordPress.CVE-2023-1112 · WordPress plugins & themes · reported by VulDBMedium 4.7
A vulnerability was found in Drag and Drop Multiple File Upload Contact Form 7 5.0.6.1 on WordPress. It has been classified as critical. Affected is an unknown function of the file admin-ajax.php. The manipulation of the argument upload_name leads to relative path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222072.
Fixed in
5.0.6.3
What to do
Update the plugin to 5.0.6.3 or newer.
Full record and what to do →NVD record github.com vuldb.com
Oct 17, 2022Drag and Drop Multiple File Upload: Does not properly check for the upload size limit set in formsCVE-2022-3282 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.5 does not properly check for the upload size limit set in forms, taking the value from user input sent when submitting the form. As a result, attackers could control the file length limit and bypass the limit set by admins in the contact form.
Product
Drag and Drop Multiple File Upload
Fixed in
1.3.6.5
What to do
Update Drag and Drop Multiple File Upload to 1.3.6.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022Drag and Drop Multiple File Upload: Allows SVG files to be uploaded by default via the dnd_codedropz_upload AJAX actionCVE-2022-0595 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.3 allows SVG files to be uploaded by default via the dnd_codedropz_upload AJAX action, which could lead to Stored Cross-Site Scripting issue
Product
Drag and Drop Multiple File Upload
Fixed in
1.3.6.3
What to do
Update Drag and Drop Multiple File Upload to 1.3.6.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Sep 4, 2019Multiple file upload restriction bypass vulnerabilities in Sentrifugo 3.2 could allow authenticated users to execute arbitrary code via a webshell.CVE-2019-15813 · Other software · Sentrifugo · reported by MITREHigh 8.8
Multiple file upload restriction bypass vulnerabilities in Sentrifugo 3.2 could allow authenticated users to execute arbitrary code via a webshell.
Product
Sentrifugo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Jun 15, 2015Cross-site request forgery (CSRF) vulnerability in the Webform Multiple File Upload module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.3 for Drupal allows rCVE-2015-4379 · Other software · Webform Multiple File Upload Project · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Webform Multiple File Upload module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of certain users for requests that delete files via unspecified vectors.
Product
Webform Multiple File Upload
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com securityfocus.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.