CVE-2026-5364

The CVE-2026-5364 case affects the WordPress plugin Drag and Drop File Upload for Contact Form 7 (versions up to 1.1.3). The root cause is that the plugin validates the file using the unsanitized extension while saving uses a sanitized one, and the file type parameter can be controlled by the att...

CVE-2022-0595

The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.3 allows SVG files to be uploaded by default via the dndcodedropzupload AJAX action, which could lead to Stored Cross-Site Scripting issue...

CVE-2025-2485

CVE-2025-2485 affects WordPress plugin Drag and Drop Multiple File Upload for Contact Form 7 (versions