Drag and Drop Multiple File Upload – Contact Form 7, CVE-2022-0595

CVE, Research URL: CVE-2022-0595
Home page URL: Security reports for Drag and Drop Multiple File Upload – Contact Form 7
Application: Drag and Drop Multiple File Upload – Contact Form 7
Published on: Mar 28, 2022
Research Description: The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.3 allows SVG files to be uploaded by default via the dnd_codedropz_upload AJAX action, which could lead to Stored Cross-Site Scripting issue
Affected versions: Min -, max 1.3.5.5.
Status: vulnerable

Drag and Drop Multiple File Upload &#8211; Contact Form 7, CVE-2022-0595