Medium severity5.4NVD Advisory· Published Mar 28, 2022· Updated Jun 17, 2026

CVE-2022-0595

Description

The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.3 allows SVG files to be uploaded by default via the dnd_codedropz_upload AJAX action, which could lead to Stored Cross-Site Scripting issue

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Codedropz/Drag And Drop Multiple File Upload Contact Form 7
cpe:2.3:a:codedropz:drag_and_drop_multiple_file_upload_-_contact_form_7:*:*:*:*:*:wordpress:*:*
Range: <1.3.6.3
WordPress/Drag And Drop Multiple File Upload Contact Form 7cpe-rescue
Package: https://wordpress.org/plugins/drag-and-drop-multiple-file-upload-contact-form-7
WordPress/Drag and Drop Multiple File Uploadllm-fuzzy
Range: <1.3.6.3

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changeset/2686614nvdPatchThird Party Advisory
wpscan.com/vulnerability/1b849957-eaca-47ea-8f84-23a3a98cc8denvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.011
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000