Skip to contentGlenwpcoder Drag And Drop Multiple File Upload For Contact Form 7 vulnerabilities
- glenwpcoder drag and drop multiple file upload for contact form 7Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Unauthenticated RCE via Control Character Filename BypassCVE-2026-187818.1 High
- glenwpcoder drag and drop multiple file upload for contact form 7Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Admin+ Stored XSS via drag_n_drop_heading_tag SettingCVE-2026-143253.5 Low
- glenwpcoder drag and drop multiple file upload for contact form 7Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'drag_n_drop_text' and 'drag_n_drop_browse_text' SettingsCVE-2026-89914.4 Medium
- glenwpcoder drag and drop multiple file upload for contact form 7Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Unauthenticated Arbitrary File Upload via Non-ASCII Filename Blacklist BypassCVE-2026-5718Public exploit8.1 High
- glenwpcoder drag and drop multiple file upload for contact form 7Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.6 - Unauthenticated Limited Arbitrary File Read via mfile FieldCVE-2026-57107.5 High
- glenwpcoder drag and drop multiple file upload for contact form 7Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.5 - Unauthenticated Arbitrary File UploadCVE-2026-34598.1 High
- codedropz contact form 7, glenwpcoder drag and drop multiple file upload for contact form 7 +1 moreDrag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.2 - Missing Authorization to Unauthenticated File DeletionCVE-2025-144573.7 Low
- glenwpcoder drag and drop multiple file upload for contact form 7Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.9.2 - Unauthenticated Limited Arbitrary File UploadCVE-2025-148426.1 Medium
- glenwpcoder drag and drop multiple file upload for contact form 7Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.0 - Directory Traversal via `wpcf7_guest_user_id` CookieCVE-2025-84645.3 Medium
- glenwpcoder drag and drop multiple file upload for contact form 7, codedropz drag and drop multiple file upload - contact form 7 +1 moreDrag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.9 - Unauthenticated Arbitrary File Upload via Insufficient Blacklist ChecksCVE-2025-3515Public exploit8.1 High
- glenwpcoder drag and drop multiple file upload for contact form 7, codedropz drag and drop multiple file upload - contact form 7 +1 moreDrag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.7 - Unauthenticated PHP Object Injection via PHAR to Arbitrary File DeletionCVE-2025-2485Fix available7.5 High
- glenwpcoder drag and drop multiple file upload for contact form 7, codedropz drag and drop multiple file upload - contact form 7 +1 moreDrag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.7 - Unauthenticated Arbitrary File DeletionCVE-2025-23288.8 High
- codedropz drag and drop multiple file upload - contact form 7, glenwpcoder drag and drop multiple file upload for contact form 7 +1 moreDrag and Drop Multiple File Upload – Contact Form 7 <= 1.3.8.5 - Limited Arbitrary File DeletionCVE-2024-122675.3 Medium
- codedropz drag and drop multiple file upload - contact form 7, glenwpcoder drag and drop multiple file upload for contact form 7 +1 moreDrag and Drop Multiple File Upload – Contact Form 7 <= 1.3.7.7 - Sensitive Information ExposureCVE-2024-37175.3 Medium
- codedropz drag and drop multiple file upload - contact form 7, glenwpcoder drag and drop multiple file upload for contact form 7 +1 moreDrag and Drop Multiple File Upload - Contact Form 7 <= 1.3.7.3 - Unauthenticated Arbitrary File UploadCVE-2023-58228.1 High