Vulnerabilities

TI-2025-12784 CVE-2025-13989 · GHSA-86fm-gv7p-jcrc

WP Dropzone <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'callback' Shortcode Attribute

LOW 28

The WP Dropzone plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'callback' shortcode attribute in all versions up to, and including, 1.1.1.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0028 Published 2025-12-12 No fix listed CWE-79

TI-2025-11708 CVE-2025-12775 · GHSA-8pj6-v8j5-4mc5

WP Dropzone <= 1.1.0 - Authenticated (Subscriber+) Arbitrary File Upload

MEDIUM 41

The WP Dropzone plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and including, 1.1.0 via the `ajax_upload_handle` function.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00657 Published 2025-11-18 No fix listed CWE-434

Vulnerabilities

Filters

WP Dropzone <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'callback' Shortcode Attribute

WP Dropzone <= 1.1.0 - Authenticated (Subscriber+) Arbitrary File Upload