Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Drag and Drop Multiple File Upload for Contact Form 7 1.3.9.9 Clear all filters
TI-2026-15385 CVE-2026-18781 · GHSA-rf4c-mm92-mpjf

Code injection in Drag and Drop Multiple File Upload for Contact Form 7

Priority LOW 38

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not validate the final name of an uploaded file after stripping characters from it, allowing unauthenticated users to defeat…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00543 Published 2026-08-21 Fixed in 1.3.9.9 CWE-94
TI-2026-12115 CVE-2026-14325 · GHSA-42hj-5w59-p3r2

Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Admin+ Stored XSS via drag_n_drop_heading_tag Setting

Priority LOW 16

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using it as an HTML tag name in front-end output, allowing users with administrator acc…

CVSS 3.1LOW 3.5 Network High privileges User interaction EPSS 0.00242 Published 2026-08-21 Fixed in 1.3.9.9 CWE-79