Is Drag and Drop Multiple File Upload for Contact Form 7 safe?

Every recorded flaw

• Aug 21, 2026Drag and Drop Multiple File Upload for Contact Form 7: Does not validate the final name of an uploaded file after stripping characters from itCVE-2026-18781 · fixed in 1.3.9.9 · reported by WPScanHigh 8.1
• Aug 21, 2026Drag and Drop Multiple File Upload for Contact Form 7: Does not escape one of its settings before using itCVE-2026-14325 · fixed in 1.3.9.9 · reported by WPScanLow 3.5
• Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.9.7 versions.CVE-2026-49055 · affects up to 1.3.9.7 · reported by PatchstackHigh 7.1
• Jun 6, 2026Drag and Drop Multiple File Upload for Contact Form 7: Stored Cross-Site ScriptingCVE-2026-8991 · affects up to 1.3.9.7 · reported by WordfenceMedium 4.4
• Apr 17, 2026Drag and Drop Multiple File Upload for Contact Form 7: Arbitrary file uploadCVE-2026-5718 · affects up to 1.3.9.7 · reported by Wordfence4.2% oddsHigh 8.1
• Apr 17, 2026Drag and Drop Multiple File Upload for Contact Form 7: Path Traversal leading to Arbitrary File ReadCVE-2026-5710 · affects up to 1.3.9.6 · reported by WordfenceHigh 7.5
• Mar 5, 2026Drag and Drop Multiple File Upload - Contact Form 7: Arbitrary file uploadsCVE-2026-3459 · affects up to 1.3.7.3 · reported by WordfenceHigh 8.1
• Jan 15, 2026Drag and Drop Multiple File Upload for Contact Form 7: Unauthorized modification of dataCVE-2025-14457 · affects up to 1.3.9.2 · reported by WordfenceLow 3.7
• Aug 16, 2025Drag and Drop Multiple File Upload for Contact Form 7: Directory TraversalCVE-2025-8464 · affects up to 1.3.9.0 · reported by WordfenceMedium 5.3
• Jun 17, 2025Drag and Drop Multiple File Upload for Contact Form 7: Arbitrary file uploadsCVE-2025-3515 · affects up to 1.3.8.9 · reported by Wordfence6.0% oddsHigh 8.1
• Mar 28, 2025Drag and Drop Multiple File Upload for Contact Form 7: PHP Object InjectionCVE-2025-2485 · affects up to 1.3.8.7 · reported by WordfenceHigh 7.5
• Mar 28, 2025Drag and Drop Multiple File Upload for Contact Form 7: Arbitrary file deletionCVE-2025-2328 · affects up to 1.3.8.7 · reported by Wordfence1.1% oddsHigh 8.8
• Jan 31, 2025Drag and Drop Multiple File Upload – Contact Form 7: Limited arbitrary file deletionCVE-2024-12267 · affects up to 1.3.8.5 · reported by WordfenceMedium 5.3
• May 2, 2024Drag and Drop Multiple File Upload – Contact Form 7: Sensitive Information ExposureCVE-2024-3717 · affects up to 1.3.7.7 · reported by WordfenceMedium 5.3
• Nov 22, 2023Drag and Drop Multiple File Upload - Contact Form 7: Arbitrary file uploadsCVE-2023-5822 · affects up to 1.3.7.3 · reported by Wordfence1.8% oddsHigh 8.1
• May 24, 2023Glen Don L: Cross-Site Request Forgery (CSRF)CVE-2022-45364 · affects up to 1.3.6.5 · reported by PatchstackMedium 5.4
• Jun 8, 2020The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress allows Unrestricted File Upload and remote code execution by setting sCVE-2020-12800 · fixed in 1.3.3.3 · reported by MITRE79% oddsCritical 9.8

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.