CVE-2022-0595

CVE-2022-0595: Drag and Drop Multiple File Upload - Contact Form 7 < 1.3.6.3 - Unauthenticated Stored XSS

Vendor Unknown

Product Drag and Drop Multiple File Upload – Contact Form 7

Weakness CWE-79 · XSS

Published March 28, 2022

Last update August 2, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.3 allows SVG files to be uploaded by default via the dnd_codedropz_upload AJAX action, which could lead to Stored Cross-Site Scripting issue

Key dates

02Disclosure timeline

March 28, 2022 CVE published

August 2, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-0595 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2025-3554 phpshe api.php cross site scripting CVE-2024-51912 WordPress IntelliWidget Elements plugin <= 2.2.7 - Cross Site Scripting (XSS) vulnerability CVE-2026-3997 Text Toggle <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute CVE-2026-23604 GFI MailEssentials AI < 22.4 Keyword Filtering Rule Stored XSS CVE-2024-3541 Campcodes Church Management System admin_user.php cross site scripting