Glenwpcoder vulnerabilities
We track 12 vulnerabilities in Glenwpcoder products across 2 products. 12 are rated high or critical, and none are known to be exploited. The most recent was published on April 17, 2026.
Latest Glenwpcoder vulnerabilities
- 8.1 High severity
Drag and Drop Multiple File Upload for Contact…: Unrestricted Upload of File with Dangerous Type
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file upload in versions up to, and including, 1.3.9.7. This is due to insufficient file type validation that occurs when custom blacklist types are config
- 7.5 High severity
Drag and Drop Multiple File Upload for Contact…: Improper Limitation of a Pathname to a Restricted Directory
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to Path Traversal leading to Arbitrary File Read in versions up to and including 1.3.9.6. This is due to the plugin using client-supplied mfile[] POST values as the so
- 8.1 High severity
Drag and Drop Multiple File Upload for Contact…: Unrestricted Upload of File with Dangerous Type
The Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'dnd_upload_cf7_upload' function in versions up to, and including, 1.3.7.3. This makes it possi
- 7.4 High severity
Drag and Drop Multiple File Upload for Contact…: Missing Authorization
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ownership check in the dnd_codedropz_upload_delete() function in all versions up to, and including, 1.3.9.2. This
- 9.8 Critical severity
Drag and Drop Multiple File Upload for Contact…: Unrestricted Upload of File with Dangerous Type
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 1.3.8.9. This makes it possible for unauthenticated attackers
- 9.8 Critical severity
Drag and Drop Multiple File Upload for…: Unrestricted Upload of File with Dangerous Type
The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.1.6 due to accepting a user‐supplied supported_type string and the uploaded filename without enforcing r
- 9.8 Critical severity
Drag and Drop Multiple File Upload for…: Improper Limitation of a Pathname to a Restricted Directory
The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation via the wc-upload-file[] parameter in all versions up to, and including, 1.1.4. This makes it possible f
- 8.8 High severity
Drag and Drop Multiple File Upload for Contact…: Deserialization of Untrusted Data
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.8.7 via deserialization of untrusted input from the 'dnd_upload_cf7_upload' function. This makes it p
- 8.8 High severity
Drag and Drop Multiple File Upload for Contact…: Improper Limitation of a Pathname to a Restricted Directory
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'dnd_remove_uploaded_files' function in all versions up to, and including, 1.3.8.7. This mak
- 9.1 Critical severity
Drag and Drop Multiple File Upload for Contact…: External Control of File Name or Path
The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to limited arbitrary file deletion due to insufficient file path validation in the dnd_codedropz_upload_delete() function in all versions up to, and including, 1.3.8.5.
- 7.5 High severity
Drag and Drop Multiple File Upload for Contact…: Insecure Storage of Sensitive Information
The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.7.7 via the '/wp-content/uploads/wp_dndcf7_uploads/wpcf7-files' directory. This makes it poss
- 9.8 Critical severity
Drag and Drop Multiple File Upload for Contact…: Unrestricted Upload of File with Dangerous Type
The Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'dnd_upload_cf7_upload' function in versions up to, and including, 1.3.7.3. This makes it possi