CVE-2022-0595

Drag and Drop Multiple File Upload - Contact Form 7 < 1.3.6.3 - Unauthenticated Stored XSS

State: Published
Severity: Not scored
Published: Mar 28, 2022
Updated: Aug 2, 2024
Reserved: Feb 14, 2022

Description

The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.3 allows SVG files to be uploaded by default via the dnd_codedropz_upload AJAX action, which could lead to Stored Cross-Site Scripting issue

Scores

The record has no CVSS score.

Weaknesses

CWE-79 Cross-site Scripting (XSS)

Affected Products

Product	Versions
Drag and Drop Multiple File Upload – Contact Form 7Unknown	1.3.6.3 to before 1.3.6.3Affected

References

https://wpscan.com/vulnerability/1b849957-eaca-47ea-8f84-23a3a98cc8de
https://plugins.trac.wordpress.org/changeset/2686614

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.