Drag and Drop Multiple File Upload for WooCommerce vulnerabilities

2 known vulnerabilities in Drag and Drop Multiple File Upload for WooCommerce from Glenwpcoder. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Drag and Drop Multiple File Upload for…: Unrestricted Upload of File with Dangerous Type

  CVE-2025-4403May 9, 2025GlenwpcoderEPSS 2.32%

  The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.1.6 due to accepting a user‐supplied supported_type string and the uploaded filename without enforcing r

• 9.8 Critical severity

  Drag and Drop Multiple File Upload for…: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2025-2941Apr 5, 2025GlenwpcoderEPSS 1.74%

  The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation via the wc-upload-file[] parameter in all versions up to, and including, 1.1.4. This makes it possible f