The Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard WordPress plugin before 2.11.1 and Drag and Drop Multiple File Upload PRO - Contact Form 7 with Remote Storage Integrations WordPress plugin before 5.0.6.4 do not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admins.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Drag N Drop Upload Cf7 Pro Plugin | — | Update drag-n-drop-upload-cf7-pro plugin to one of the following versions, or a newer patched version: 2.11.1, 5.0.6.4 | May 15, 2025 | Mar 15, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub