CVE-2022-0595
Drag and Drop Multiple File Upload - Contact Form 7 < 1.3.6.3 - Unauthenticated Stored XSS
CVE-2022-0595 is a medium vulnerability (CVSS 5.4) in Codedropz Drag And Drop Multiple File Upload - Contact Form 7, published March 28, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 13.5%, the 96th percentile. No source names a fixed version.
- Severity
- 5.4 MediumCVSS 3.1, NVD
- Exploit chance
- 13.5%EPSS, 96th percentile
- Exploitation
- None known1 public exploit
- Fixed in
- No fix listedNo source names one
Description
The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.3 allows SVG files to be uploaded by default via the dnd_codedropz_upload AJAX action, which could lead to Stored Cross-Site Scripting issue
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | WordPress Contact Form 7 <1.3.6.3 - Stored Cross-Site Scripting |
What each source reports
NVD Score used
The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.3 allows SVG files to be uploaded by default via the dnd_codedropz_upload AJAX action, which could lead to Stored Cross-Site Scripting issue
- Record
CVE-2022-0595- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE ListNo score
Drag and Drop Multiple File Upload - Contact Form 7 < 1.3.6.3 - Unauthenticated Stored XSS
The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.3 allows SVG files to be uploaded by default via the dnd_codedropz_upload AJAX action, which could lead to Stored Cross-Site Scripting issue
- Record
CVE-2022-0595- Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2022-15702No score
The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.3 allows SVG files to be uploaded by default via the dnd_codedropz_upload AJAX action, which could lead to Stored Cross-Site Scripting issue
- Record
EUVD-2022-15702- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hr6r-r632-pjw9
The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.3 allows SVG files to be...
The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.3 allows SVG files to be uploaded by default via the dnd_codedropz_upload AJAX action, which could lead to Stored Cross-Site Scripting issue
- Record
GHSA-hr6r-r632-pjw9- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, Nuclei, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.