CVE-2022-0595

🗓️ 28 Mar 2022 17:22:57Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 115 Views🌐 WEB

The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.3 allows SVG files to be uploaded by default via the dnd_codedropz_upload AJAX action, leading to a Stored Cross-Site Scripting issue

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2022-0595	28 Mar 202222:42	–	circl
CNNVD	WordPress plugin Drag and Drop Multiple File Upload 跨站脚本漏洞	28 Mar 202200:00	–	cnnvd
CNVD	WordPress Drag and Drop Multiple File Upload plugin cross-site scripting vulnerability	30 Mar 202200:00	–	cnvd
Cvelist	CVE-2022-0595 Drag and Drop Multiple File Upload - Contact Form 7 < 1.3.6.3 - Unauthenticated Stored XSS	28 Mar 202217:22	–	cvelist
EUVD	EUVD-2022-15702	28 Mar 202217:22	–	euvd
Hacker One	Nord Security: Stored XSS at nordvpn.com	19 Jan 202323:35	–	hackerone
Nuclei	WordPress Contact Form 7 <1.3.6.3 - Stored Cross-Site Scripting	6 Jun 202603:01	–	nuclei
NVD	CVE-2022-0595	28 Mar 202218:15	–	nvd
Patchstack	WordPress Drag and Drop Multiple File Upload – Contact Form 7 plugin <= 1.3.6.2 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability	7 Mar 202200:00	–	patchstack
Prion	Cross site scripting	28 Mar 202218:15	–	prion

NVD

Vulners

Node

codedropz drag_and_drop_multiple_file_upload_-_contact_form_7Range<1.3.6.3wordpress

[
  {
    "product": "Drag and Drop Multiple File Upload – Contact Form 7",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.3.6.3",
        "status": "affected",
        "version": "1.3.6.3",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset/2686614
wpscan	www.wpscan.com/vulnerability/1b849957-eaca-47ea-8f84-23a3a98cc8de

Parameter	Position	Path	Description	CWE
upload-file	request body	/wp-admin/admin-ajax.php	Stored Cross-Site Scripting via SVG upload in dnd_codedropz_upload AJAX action	CWE-79

21 Nov 2024 06:38Current

5.2Medium risk

Vulners AI Score5.2

CVSS 23.5

CVSS 3.15.4

EPSS0.05776

CWE-79