CVE-2026-5364

The CVE-2026-5364 case affects the WordPress plugin Drag and Drop File Upload for Contact Form 7 (versions up to 1.1.3). The root cause is that the plugin validates the file using the unsanitized extension while saving uses a sanitized one, and the file type parameter can be controlled by the att...

CVE-2022-0595

The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.3 allows SVG files to be uploaded by default via the dndcodedropzupload AJAX action, which could lead to Stored Cross-Site Scripting issue...

CVE-2025-2485

The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 1.3.8.7 . The root cause is the deserialization of untrusted input from the dnd_upload_cf7_upload function, which allows attackers to inject a P...