Skip to content
OpenAdvisories

Vendor

glenwpcoder

15 known vulnerabilities.

glenwpcoder at a glance

Last 12 months
6
Critical · all time
2
Exploited · all time
0
Public exploit · all time
3
New vulnerabilities per month · last 12 months
0 1 2 December 2025: 0 vulnerabilities Dec 2025 January 2026: 2 vulnerabilities February 2026: 0 vulnerabilities March 2026: 1 vulnerability Mar April 2026: 2 vulnerabilities May 2026: 0 vulnerabilities June 2026: 1 vulnerability Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202610
May 202600
Apr 202620
Mar 202610
Feb 202600
Jan 202620
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202510
Jul 202500
Jun 202510
May 202511
Apr 202511
Mar 202520
Feb 202500
Jan 202510
Dec 202400

Products

Drag and Drop Multiple File Upload for Contact Form 7 13 Drag and Drop Multiple File Upload for WooCommerce 2
All Critical High Medium Low Exploited only Public exploit

15 results · Feed

  • Medium 4.4
    CVE-2026-8991

    Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'drag_n_drop_text' and 'drag_n_drop_browse_text' Settings

    The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'drag_n_drop_text' and 'drag_n_drop_browse_text' Settings in all versions up to, and including, 1.3.9.7 due to insufficient input s…

    glenwpcoder Drag and Drop Multiple File Upload for Contact Form 7 Web / CMS
  • High 8.1
    CVE-2026-5718 Public exploit

    Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Unauthenticated Arbitrary File Upload via Non-ASCII Filename Blacklist Bypass

    The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file upload in versions up to, and including, 1.3.9.7. This is due to insufficient file type validation that occurs when custom blacklist types are confi…

    glenwpcoder Drag and Drop Multiple File Upload for Contact Form 7 Web / CMS
  • High 7.5
    CVE-2026-5710

    Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.6 - Unauthenticated Limited Arbitrary File Read via mfile Field

    The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to Path Traversal leading to Arbitrary File Read in versions up to and including 1.3.9.6. This is due to the plugin using client-supplied mfile[] POST values as the s…

    glenwpcoder Drag and Drop Multiple File Upload for Contact Form 7 Web / CMS
  • High 8.1
    CVE-2026-3459

    Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.5 - Unauthenticated Arbitrary File Upload

    The Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'dnd_upload_cf7_upload' function in versions up to, and including, 1.3.7.3. This makes it poss…

    glenwpcoder Drag and Drop Multiple File Upload for Contact Form 7 Web / CMS
  • Low 3.7
    CVE-2025-14457

    Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.2 - Missing Authorization to Unauthenticated File Deletion

    The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ownership check in the dnd_codedropz_upload_delete() function in all versions up to, and including, 1.3.9.2. Thi…

    glenwpcoder Drag and Drop Multiple File Upload for Contact Form 7 Web / CMS
  • Medium 6.1
    CVE-2025-14842

    Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.9.2 - Unauthenticated Limited Arbitrary File Upload

    The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to limited upload of files with a dangerous type in all versions up to, and including, 1.3.9.2. This is due to the plugin not blocking .phar and .svg files. This makes …

    glenwpcoder Drag and Drop Multiple File Upload for Contact Form 7 Web / CMS
  • Medium 5.3
    CVE-2025-8464

    Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.0 - Directory Traversal via `wpcf7_guest_user_id` Cookie

    The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.9.0 via the wpcf7_guest_user_id cookie. This makes it possible for unauthenticated attackers to uploa…

    glenwpcoder Drag and Drop Multiple File Upload for Contact Form 7 Web / CMS
  • High 8.1
    CVE-2025-3515 Public exploit

    Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.9 - Unauthenticated Arbitrary File Upload via Insufficient Blacklist Checks

    The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 1.3.8.9. This makes it possible for unauthenticated attackers…

    glenwpcoder Drag and Drop Multiple File Upload for Contact Form 7 Web / CMS
  • Critical 9.8
    CVE-2025-4403 Public exploit

    Drag and Drop Multiple File Upload for WooCommerce <= 1.1.6 - Unauthenticated Arbitrary File Upload via upload Function

    The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.1.6 due to accepting a user‐supplied supported_type string and the uploaded filename without enforcing …

    glenwpcoder Drag and Drop Multiple File Upload for WooCommerce Web / CMS
  • Critical 9.8
    CVE-2025-2941

    Drag and Drop Multiple File Upload for WooCommerce <= 1.1.4 - Unauthenticated Arbitrary File Move

    The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation via the wc-upload-file[] parameter in all versions up to, and including, 1.1.4. This makes it possible …

    glenwpcoder Drag and Drop Multiple File Upload for WooCommerce Web / CMS
  • High 7.5
    CVE-2025-2485

    Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.7 - Unauthenticated PHP Object Injection via PHAR to Arbitrary File Deletion

    The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.8.7 via deserialization of untrusted input from the 'dnd_upload_cf7_upload' function. This makes it …

    glenwpcoder Drag and Drop Multiple File Upload for Contact Form 7 Web / CMS
  • High 8.8
    CVE-2025-2328

    Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.7 - Unauthenticated Arbitrary File Deletion

    The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'dnd_remove_uploaded_files' function in all versions up to, and including, 1.3.8.7. This ma…

    glenwpcoder Drag and Drop Multiple File Upload for Contact Form 7 Web / CMS
  • Medium 5.3
    CVE-2024-12267

    Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.8.5 - Limited Arbitrary File Deletion

    The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to limited arbitrary file deletion due to insufficient file path validation in the dnd_codedropz_upload_delete() function in all versions up to, and including, 1.3.8.5.…

    glenwpcoder Drag and Drop Multiple File Upload for Contact Form 7 Web / CMS
  • Medium 5.3
    CVE-2024-3717

    Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.7.7 - Sensitive Information Exposure

    The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.7.7 via the '/wp-content/uploads/wp_dndcf7_uploads/wpcf7-files' directory. This makes it pos…

    glenwpcoder Drag and Drop Multiple File Upload for Contact Form 7 Web / CMS
  • High 8.1
    CVE-2023-5822

    Drag and Drop Multiple File Upload - Contact Form 7 <= 1.3.7.3 - Unauthenticated Arbitrary File Upload

    The Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'dnd_upload_cf7_upload' function in versions up to, and including, 1.3.7.3. This makes it poss…

    glenwpcoder Drag and Drop Multiple File Upload for Contact Form 7 Web / CMS