Vulnerability history

Unauthenticated RCE via Control Character Filename Bypass vulnerability

Admin+ Stored XSS via drag_n_drop_heading_tag Setting vulnerability

Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability

Cross Site Scripting (XSS) vulnerability

Unauthenticated Arbitrary File Upload via Non-ASCII Filename Blacklist Bypass vulnerability

Unauthenticated Limited Arbitrary File Read via mfile Field vulnerability

Unauthenticated Arbitrary File Upload vulnerability

Missing Authorization to Unauthenticated File Deletion vulnerability

WordPress Drag and Drop Multiple File Upload - Contact Form 7 plugin <= 1.3.9.2 - Unauthenticated Limited Arbitrary File Upload vulnerability

Directory Traversal via `wpcf7_guest_user_id` Cookie vulnerability

Unauthenticated Arbitrary File Upload via Insufficient Blacklist Checks vulnerability

Unauthenticated PHP Object Injection via PHAR to Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion vulnerability

Limited Arbitrary File Deletion vulnerability

Sensitive Information Exposure vulnerability

Wordpress Drag and Drop Multiple File Upload - Contact Form 7 plugin <= 1.3.7.3 - Unauthenticated Arbitrary File Upload vulnerability

Multiple CSRF vulnerabilities

File Upload Size Limit Bypass vulnerability

Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

Unauthenticated Remote Code Execution vulnerability

Unauthenticated File Upload vulnerability leading to Remote Code Execution (RCE)