CodeDropz vulnerabilities
We track 8 vulnerabilities in CodeDropz products across 3 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on January 15, 2026.
Latest CodeDropz vulnerabilities
- 7.4 High severity
Drag and Drop Multiple File Upload for Contact…: Missing Authorization
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ownership check in the dnd_codedropz_upload_delete() function in all versions up to, and including, 1.3.9.2. This
- 9.8 Critical severity
Drag and Drop Multiple File Upload (Pro) -…: Unrestricted Upload of File with Dangerous Type
The Drag and Drop Multiple File Upload (Pro) - WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the dnd_upload_cf7_upload_chunks() function in version 5.0 - 5.0.5 (when bundled with the PrintSpace
- 9.8 Critical severity
Drag and Drop Multiple File Upload for Contact…: Unrestricted Upload of File with Dangerous Type
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 1.3.8.9. This makes it possible for unauthenticated attackers
- 8.8 High severity
Drag and Drop Multiple File Upload for Contact…: Deserialization of Untrusted Data
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.8.7 via deserialization of untrusted input from the 'dnd_upload_cf7_upload' function. This makes it p
- 8.8 High severity
Drag and Drop Multiple File Upload for Contact…: Improper Limitation of a Pathname to a Restricted Directory
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'dnd_remove_uploaded_files' function in all versions up to, and including, 1.3.8.7. This mak
- 9.1 Critical severity
Drag and Drop Multiple File Upload for Contact…: External Control of File Name or Path
The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to limited arbitrary file deletion due to insufficient file path validation in the dnd_codedropz_upload_delete() function in all versions up to, and including, 1.3.8.5.
- 7.5 High severity
Drag and Drop Multiple File Upload for Contact…: Insecure Storage of Sensitive Information
The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.7.7 via the '/wp-content/uploads/wp_dndcf7_uploads/wpcf7-files' directory. This makes it poss
- 9.8 Critical severity
Drag and Drop Multiple File Upload for Contact…: Unrestricted Upload of File with Dangerous Type
The Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'dnd_upload_cf7_upload' function in versions up to, and including, 1.3.7.3. This makes it possi