CVE-2023-4821

5.4 mediumEPSS 0.4%

Medium (5.4) in codedropz drag and drop multiple file uploader. EPSS 0.4% chance of exploitation in the next 30 days.

The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.1 does not filter all potentially dangerous file extensions. Therefore, an attacker can upload unsafe .shtml or .svg files containing malicious scripts.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 38% of CVEs (scores of 2026-10-31)
Published: 2023-10-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

codedropz:drag_and_drop_multiple_file_uploader

References

https://wpscan.com/vulnerability/3ac0853b-03f7-44b9-aa9b-72df3e01a9b5
https://wpscan.com/vulnerability/3ac0853b-03f7-44b9-aa9b-72df3e01a9b5

Check your stack JSON