Known vulnerabilities in Drag and Drop Multiple File Upload for Contact Form 7
This simple plugin create Drag & Drop or choose Multiple File upload in your Confact Form 7 Forms.
16Reported vulnerabilities
9.8Highest CVSS score
1.3.9.8Latest version
60,000+Active installs
What to do now
Update Drag and Drop Multiple File Upload for Contact Form 7 to 1.3.9.9 or later.
16 of these have a fixed version available. Updating resolves them.
Reported vulnerabilities
| CVE | Severity | Exploit probability |
Affected versions | Fixed in | Published |
|---|---|---|---|---|---|
| CVE-2020-12800 | Critical | 78.6% | Before 1.3.3.3 | 1.3.3.3 |
June 8, 2020 |
| CVE-2025-3515 | Critical | 5.1% | Before 1.3.9.0 | 1.3.9.0 |
June 17, 2025 |
| CVE-2023-5822 | Critical | 1.8% | 1.3.7.3 and earlier | 1.3.7.4 |
November 22, 2023 |
| CVE-2026-18781 | Critical | 0.3% | Before 1.3.9.9 | 1.3.9.9 |
August 24, 2026 |
| CVE-2026-5718 | High | 4.2% | 0 to 1.3.9.7 (inclusive) | 1.3.9.8 |
April 17, 2026 |
| CVE-2025-2328 | High | 1.1% | Before 1.3.8.8 | 1.3.8.8 |
March 28, 2025 |
| CVE-2024-12267 | Critical | 0.3% | Before 1.3.8.6 | 1.3.8.6 |
January 31, 2025 |
| CVE-2025-2485 | High | 0.6% | Before 1.3.8.9 | 1.3.8.9 |
March 28, 2025 |
| CVE-2022-45364 | High | 0.2% | 1.3.6.5 and earlier | 1.3.6.6 |
February 24, 2023 |
| CVE-2026-3459 | High | 0.6% | 0 to 1.3.9.5 (inclusive) | 1.3.9.6 |
March 5, 2026 |
| CVE-2026-5710 | High | 0.7% | 0 to 1.3.9.6 (inclusive) | 1.3.9.7 |
April 17, 2026 |
| CVE-2025-14457 | High | 0.2% | 1.3.9.2 and earlier | 1.3.9.3 |
January 15, 2026 |
| CVE-2026-49055 | High | 0.2% | 1.3.9.7 and earlier | 1.3.9.8 |
June 3, 2026 |
| CVE-2025-8464 | Medium | 0.7% | 0 to 1.3.9.0 (inclusive) | 1.3.9.1 |
August 16, 2025 |
| CVE-2026-8991 | Medium | 0.3% | 0 to 1.3.9.7 (inclusive) | 1.3.9.8 |
June 6, 2026 |
| CVE-2026-14325 | Medium | 0.1% | Before 1.3.9.9 | 1.3.9.9 |
August 24, 2026 |