https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-14457.htmlhttps://patchthecve.com/cve/CVE-2025-14457.htmlWed, 17 Jun 2026 08:35:57 +0000LOW 3.7: The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ownership check in the dnd_codedropz_upload_delete() function in all versions up to, and including, 1.3.9.2. This makes it possible for unauthenticated ahttps://patchthecve.com/cve/CVE-2025-3515.htmlhttps://patchthecve.com/cve/CVE-2025-3515.htmlWed, 17 Jun 2026 09:20:05 +0000HIGH 8.1: The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 1.3.8.9. This makes it possible for unauthenticated attackers to bypass the plugin's blacklist and uplhttps://patchthecve.com/cve/CVE-2025-2485.htmlhttps://patchthecve.com/cve/CVE-2025-2485.htmlWed, 17 Jun 2026 09:07:02 +0000HIGH 7.5: The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.8.7 via deserialization of untrusted input from the 'dnd_upload_cf7_upload' function. This makes it possible for attackers to inject a PHP https://patchthecve.com/cve/CVE-2025-2328.htmlhttps://patchthecve.com/cve/CVE-2025-2328.htmlWed, 17 Jun 2026 09:06:45 +0000HIGH 8.8: The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'dnd_remove_uploaded_files' function in all versions up to, and including, 1.3.8.7. This makes it possible for unauthenticated attachttps://patchthecve.com/cve/CVE-2024-12267.htmlhttps://patchthecve.com/cve/CVE-2024-12267.htmlWed, 17 Jun 2026 06:59:21 +0000MEDIUM 5.3: The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to limited arbitrary file deletion due to insufficient file path validation in the dnd_codedropz_upload_delete() function in all versions up to, and including, 1.3.8.5. This makes it possible for unauthenticat