Drag And Drop Multiple File Upload For Contact Form 7
Monthly
Remote code execution via file upload bypass in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin (versions before 1.3.9.9) is exploitable by unauthenticated attackers against public-facing WordPress contact forms. The plugin strips certain characters from uploaded filenames as a sanitization step but fails to re-validate the resulting filename against its file type allowlist, enabling an attacker to craft a filename that survives stripping as a server-executable extension (e.g., PHP). A publicly available proof-of-concept exploit exists; a vendor patch is available at version 1.3.9.9 and should be applied immediately given the no-authentication, network-accessible attack surface.
Stored XSS in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin (versions before 1.3.9.9) allows administrator-level users to inject arbitrary JavaScript via an unsanitized plugin setting used as an HTML tag name in front-end output. Any visitor loading a page that renders the upload field will execute the injected script in their browser context. A publicly available exploit exists; the vulnerability is rated CVSS 3.5 due to the high-privilege requirement, though post-authentication stored XSS can still enable session hijacking or malicious redirects against site visitors.
Stored Cross-Site Scripting in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin (all versions through 1.3.9.7) allows authenticated administrators to persist malicious JavaScript via the 'drag_n_drop_text' and 'drag_n_drop_browse_text' plugin settings fields, which subsequently execute in the browsers of any site visitor accessing a page containing an affected CF7 upload form. The CVSS Scope:Changed designation reflects this cross-user impact - a compromised or rogue admin can silently weaponize public-facing forms without further interaction. No public exploit or CISA KEV listing exists at time of analysis, and the CVSS score of 4.4 reflects the high privilege and high complexity prerequisites that substantially limit opportunistic exploitation.
Remote code execution via file upload bypass in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin (versions before 1.3.9.9) is exploitable by unauthenticated attackers against public-facing WordPress contact forms. The plugin strips certain characters from uploaded filenames as a sanitization step but fails to re-validate the resulting filename against its file type allowlist, enabling an attacker to craft a filename that survives stripping as a server-executable extension (e.g., PHP). A publicly available proof-of-concept exploit exists; a vendor patch is available at version 1.3.9.9 and should be applied immediately given the no-authentication, network-accessible attack surface.
Stored XSS in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin (versions before 1.3.9.9) allows administrator-level users to inject arbitrary JavaScript via an unsanitized plugin setting used as an HTML tag name in front-end output. Any visitor loading a page that renders the upload field will execute the injected script in their browser context. A publicly available exploit exists; the vulnerability is rated CVSS 3.5 due to the high-privilege requirement, though post-authentication stored XSS can still enable session hijacking or malicious redirects against site visitors.
Stored Cross-Site Scripting in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin (all versions through 1.3.9.7) allows authenticated administrators to persist malicious JavaScript via the 'drag_n_drop_text' and 'drag_n_drop_browse_text' plugin settings fields, which subsequently execute in the browsers of any site visitor accessing a page containing an affected CF7 upload form. The CVSS Scope:Changed designation reflects this cross-user impact - a compromised or rogue admin can silently weaponize public-facing forms without further interaction. No public exploit or CISA KEV listing exists at time of analysis, and the CVSS score of 4.4 reflects the high privilege and high complexity prerequisites that substantially limit opportunistic exploitation.