CVE-2022-0595

PoC —

CVSS 3.1

5.4 medium

EPSS

14%p96

Published

Mar 28, 2022 (Mar 28, 2022)

Modified

Jun 17, 2026

Description

The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.3 allows SVG files to be uploaded by default via the dnd_codedropz_upload AJAX action, which could lead to Stored Cross-Site Scripting issue

Vendors: codedropz
Products: drag and drop multiple file upload - contact form 7
Ecosystems: WordPress
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (13.6%)

In the news0 stories

No ingested article mentions this CVE yet.