Drag And Drop Multiple File Upload For Contact Form 7

WordPress plugin · drag-and-drop-multiple-file-upload-for-contact-form-7 · WordPress.org ↗

Critical

High

Known total

Unfixed

Running Drag And Drop Multiple File Upload For Contact Form 7 on your site? WP Alerts checks your installed version against every entry below and emails you only when one affects you. Free, no tracking.

Scan a site Monitor my sites →

Severity	Vulnerability	Affected	Fixed in	CVE	Published
HIGH CVSS 8.1	Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Unauthenticated RCE via Control Character Filename Bypass CVE.org	>=0, <1.3.9.9	v1.3.9.9	CVE-2026-18781	Aug 21, 2026
LOW CVSS 3.5	Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Admin+ Stored XSS via drag_n_drop_heading_tag Setting CVE.org	>=0, <1.3.9.9	v1.3.9.9	CVE-2026-14325	Aug 21, 2026

Data aggregated from WPVulnerability, NVD/NIST, ENISA EUVD, CVE.org and WordPress.org. Provided as-is; verify with the plugin author before acting. Disclaimer.