Read the docs
TI-2023-01210 Aliases CVE-2023-1282GHSA-p6xh-r33c-c9h2

Drag and Drop Multiple File Upload PRO - Reflected Cross-Site Scripting

Priority MEDIUM 60Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

The Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard WordPress plugin before 2.11.1 and Drag and Drop Multiple File Upload PRO - Contact Form 7 with Remote Storage Integrations WordPress plugin before 5.0.6.4 do not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admins.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00542 45th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by the CNA and NVD
Fix Fixed Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard (Unknown): 2.11.1Drag and Drop Multiple File Upload PRO - Contact Form 7 with Remote Storage Integrations (Unknown): 5.0.6.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownDrag and Drop Multiple File Upload PRO - Contact Form 7 Standard2.0.0 to before 2.11.12.11.1Patch availableCNA
UnknownDrag and Drop Multiple File Upload PRO - Contact Form 7 with Remote Storage Integrations5.0.0.0 to before 5.0.6.45.0.6.4Patch availableCNA
  • Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard VendorUnknown Affected 2.0.0 to before 2.11.1 Fixed in 2.11.1 Patch available CNA
  • Drag and Drop Multiple File Upload PRO - Contact Form 7 with Remote Storage Integrations VendorUnknown Affected 5.0.0.0 to before 5.0.6.4 Fixed in 5.0.6.4 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:codedropz:drag_and_drop_multiple_file_upload_-_contact_form_7:*:*:*:*:standard:wordpress:*:*before 2.11.1Vulnerableglenwpcoder
cpe:2.3:a:codedropz:drag_and_drop_multiple_file_upload_-_contact_form_7:*:*:*:*:pro:wordpress:*:*before 5.0.6.4Vulnerableglenwpcoder
  • cpe:2.3:a:codedropz:drag_and_drop_multiple_file_upload_-_contact_form_7:*:*:*:*:standard:wordpress:*:* Versions before 2.11.1 Vulnerable ·glenwpcoder
  • cpe:2.3:a:codedropz:drag_and_drop_multiple_file_upload_-_contact_form_7:*:*:*:*:pro:wordpress:*:* Versions before 5.0.6.4 Vulnerable ·glenwpcoder

Remediation

  • Fix · CNA Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard (Unknown) Fixed in 2.11.1
  • Fix · CNA Drag and Drop Multiple File Upload PRO - Contact Form 7 with Remote Storage Integrations (Unknown) Fixed in 5.0.6.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-1282
  2. 2026-10-03 Alias added: GHSA-p6xh-r33c-c9h2

References

Exploit 2

  • TI-2020-10177 The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress… CVSS 3.1CRITICAL 9.8
  • TI-2023-01052 Drag and Drop Multiple File Upload Contact Form 7 admin-ajax.php path traversal CVSS 3.1CRITICAL 9.8
  • TI-2022-03032 Drag and Drop Multiple File Upload < 1.3.6.5 - File Upload Size Limit Bypass CVSS 3.1MEDIUM 4.3
  • TI-2025-03087 Unrestricted file upload in glenwpcoder Drag and Drop Multiple File Upload for Contact… CVSS 3.1CRITICAL 9.8
  • TI-2023-05358 Drag and Drop Multiple File Upload - Contact Form 7 <= 1.3.7.3 - Unauthenticated Arbitrary File Upload CVSS 3.1CRITICAL 9.8
  • TI-2024-11378 Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.8.5 - Limited Arbitrary File Deletion CVSS 3.1CRITICAL 9.1
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences