CVE-2022-0595
MEDIUM NUCLEIWordPress <1.3.6.3 - XSS
Title source: llmDescription
The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.3 allows SVG files to be uploaded by default via the dnd_codedropz_upload AJAX action, which could lead to Stored Cross-Site Scripting issue
Exploits (1)
github
NO CODE
2 stars
by tomorroisnew · poc
https://github.com/tomorroisnew/CVE/tree/main/CVE-2022-0595
Nuclei Templates (1)
WordPress Contact Form 7 <1.3.6.3 - Stored Cross-Site Scripting
MEDIUMby akincibor
Scores
CVSS v3
5.4
EPSS
0.0578
EPSS Percentile
90.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (1)
codedropz/drag_and_drop_multiple_file_upload_-_contact_form_7
< 1.3.6.3
Published
Mar 28, 2022
Tracked Since
Feb 18, 2026