Vulnerability · Published Mar 28, 2022 · Assigned by WPScan
CVE-2022-0595Drag and Drop Multiple File Upload - Contact Form 7 < 1.3.6.3 - Unauthenticated Stored XSS
Medium 5.4
In plain English
A medium-severity cross-site scripting in Drag and Drop Multiple File Upload – Contact Form 7 from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 13.6% (higher than 96% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS NVD)5.4Medium
Exploit odds (30 days)13.6%top 3.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Nuclei
Official description
The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.3 allows SVG files to be uploaded by default via the dnd_codedropz_upload AJAX action, which could lead to Stored Cross-Site Scripting issue
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Drag and Drop Multiple File Upload – Contact Form 7 | 1.3.6.3 – before 1.3.6.3 |
Weakness: CWE-79
References
- https://wpscan.com/vulnerability/1b849957-eaca-47ea-8f84-23a3a98cc8de x_refsource_MISC
- https://plugins.trac.wordpress.org/changeset/2686614 x_refsource_CONFIRM