Skip to content
OpenAdvisories

Vendor

glenwpcoder

15 known vulnerabilities.

Products

Drag and Drop Multiple File Upload for Contact Form 7 13 Drag and Drop Multiple File Upload for WooCommerce 2
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 8.1
    CVE-2026-5718 Public exploit

    Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Unauthenticated Arbitrary File Upload via Non-ASCII Filename Blacklist Bypass

    The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file upload in versions up to, and including, 1.3.9.7. This is due to insufficient file type validation that occurs when custom blacklist types are confi…

    glenwpcoder Drag and Drop Multiple File Upload for Contact Form 7 Web / CMS
  • High 7.5
    CVE-2026-5710

    Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.6 - Unauthenticated Limited Arbitrary File Read via mfile Field

    The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to Path Traversal leading to Arbitrary File Read in versions up to and including 1.3.9.6. This is due to the plugin using client-supplied mfile[] POST values as the s…

    glenwpcoder Drag and Drop Multiple File Upload for Contact Form 7 Web / CMS
  • High 8.1
    CVE-2026-3459

    Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.5 - Unauthenticated Arbitrary File Upload

    The Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'dnd_upload_cf7_upload' function in versions up to, and including, 1.3.7.3. This makes it poss…

    glenwpcoder Drag and Drop Multiple File Upload for Contact Form 7 Web / CMS
  • High 8.1
    CVE-2025-3515 Public exploit

    Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.9 - Unauthenticated Arbitrary File Upload via Insufficient Blacklist Checks

    The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 1.3.8.9. This makes it possible for unauthenticated attackers…

    glenwpcoder Drag and Drop Multiple File Upload for Contact Form 7 Web / CMS
  • High 7.5
    CVE-2025-2485

    Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.7 - Unauthenticated PHP Object Injection via PHAR to Arbitrary File Deletion

    The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.8.7 via deserialization of untrusted input from the 'dnd_upload_cf7_upload' function. This makes it …

    glenwpcoder Drag and Drop Multiple File Upload for Contact Form 7 Web / CMS
  • High 8.8
    CVE-2025-2328

    Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.7 - Unauthenticated Arbitrary File Deletion

    The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'dnd_remove_uploaded_files' function in all versions up to, and including, 1.3.8.7. This ma…

    glenwpcoder Drag and Drop Multiple File Upload for Contact Form 7 Web / CMS
  • High 8.1
    CVE-2023-5822

    Drag and Drop Multiple File Upload - Contact Form 7 <= 1.3.7.3 - Unauthenticated Arbitrary File Upload

    The Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'dnd_upload_cf7_upload' function in versions up to, and including, 1.3.7.3. This makes it poss…

    glenwpcoder Drag and Drop Multiple File Upload for Contact Form 7 Web / CMS