Skip to content
PluginCanary

Drag and Drop Multiple File Upload for

Drag and Drop Multiple File Upload for Contact Form 7
by Glen Don Mongaya · 60,000+ active installs · Checked 4 Nov 2026
Healthy

Healthy: maintained, last release 30 Oct 2026, 18 releases in 24 months, no unpatched vulnerabilities.

86/ 100 Canary Score
Sub-scores for Drag and Drop Multiple File Upload for
Ownership100
Maintenance100
Security60
SupportNo data
ReputationNo data

How the score works

Quick answers

Is Drag and Drop Multiple File Upload for still maintained?
Yes. Last release 30 Oct 2026, 18 releases in the last 24 months. 30 Oct 2026 · wordpress.org
Who owns Drag and Drop Multiple File Upload for, and has it changed hands?
No change recorded. Main committer glenwpcoder since Dec 2018. 4 Nov 2026 · SVN log
Was Drag and Drop Multiple File Upload for removed from wordpress.org?
No. Listed on wordpress.org as of 4 Nov 2026. 4 Nov 2026 · wordpress.org
Is Drag and Drop Multiple File Upload for safe?
20 known vulnerabilities, all fixed (latest in 1.3.9.9). Not on the exploited list. 24 Aug 2026 · Wordfence Intelligence
Is the latest Drag and Drop Multiple File Upload for update safe to install?
No ownership change before 1.4.1. No one-star spike after it. 30 Oct 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
plugin-master4 Dec 2018 to 4 Dec 2018, 1 commits
glenwpcoder4 Dec 2018 to 30 Oct 2026, 155 commits

2 committers recorded. No ownership change since 2018.

Maintenance

Last release
5 days ago
Releases, 24 months
18
Tested up to
7.0 vs 7.1
Requires PHP
5.2.4 supported 8.2+
Releases per quarter
Releases per quarter for Drag and Drop Multiple File Upload for
Q1 20243
Q2 20245
Q3 20242
Q4 20242
Q1 20253
Q2 20252
Q3 20251
Q4 20252
Q1 20263
Q2 20262
Q3 20262
Q4 20261

Last release 30 Oct 2026. Tested up to 7.0, 1 major version behind WordPress 7.1.

Reputation

Last 90 days: no reviews. Lifetime: 4.8.

Average rating per quarter for Drag and Drop Multiple File Upload for
Q4 20235.0
Q1 20245.0
Q2 20244.0
Q1 20255.0
Q3 20253.0
Q1 20265.0

Average rating stayed at 5.0 between Q4 2023 and Q1 2026.

Rating distribution
5 star88
4 star2
3 star0
2 star0
1 star4
Latest low reviews

Security record

14 vulnerabilities in 24 months (20 on record), all patched (latest fixed in 1.3.9.9).

Show 20 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
24 Aug 2026Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Unauthenticated Remote Code Execution9.8< 1.3.9.91.3.9.9Patched before disclosure
24 Aug 2026Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4< 1.3.9.91.3.9.9Patched before disclosure
5 Jun 2026Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'drag_n_drop_text' and 'drag_n_drop_browse_text' Settings4.4<= 1.3.9.71.3.9.8Patched before disclosure
3 Jun 2026Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Unauthenticated Stored Cross-Site Scripting7.2<= 1.3.9.71.3.9.8Patched before disclosure
17 Apr 2026Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Unauthenticated Arbitrary File Upload via Non-ASCII Filename Blacklist Bypass8.1<= 1.3.9.71.3.9.839
17 Apr 2026Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.6 - Unauthenticated Limited Arbitrary File Read via mfile Field7.5<= 1.3.9.61.3.9.7Patched before disclosure
5 Mar 2026Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.5 - Unauthenticated Arbitrary File Upload8.1<= 1.3.9.51.3.9.6Patched before disclosure
14 Jan 2026Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.2 - Missing Authorization to Unauthenticated File Deletion3.7<= 1.3.9.21.3.9.3Patched before disclosure
6 Jan 2026Drag and Drop Multiple File Upload - Contact Form 7 <= 1.3.9.2 - Unauthenticated Limited Arbitrary File Upload6.1<= 1.3.9.21.3.9.3Patched before disclosure
15 Aug 2025Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.0 - Directory Traversal via `wpcf7_guest_user_id` Cookie5.3<= 1.3.9.01.3.9.1Patched before disclosure
16 Jun 2025Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.9 - Unauthenticated Arbitrary File Upload via Insufficient Blacklist Checks8.1<= 1.3.8.91.3.9.0Patched before disclosure
27 Mar 2025Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.7 - Unauthenticated PHP Object Injection via PHAR to Arbitrary File Deletion7.5<= 1.3.8.81.3.8.940
27 Mar 2025Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.7 - Unauthenticated Arbitrary File Deletion8.8<= 1.3.8.71.3.8.8Patched before disclosure
30 Jan 2025Drag and Drop Multiple File Upload - Contact Form 7 <= 1.3.8.5 - Limited Arbitrary File Deletion5.3<= 1.3.8.51.3.8.6Patched before disclosure
29 Apr 2024Drag and Drop Multiple File Upload - Contact Form 7 <= 1.3.7.7 - Sensitive Information Exposure5.3<= 1.3.7.71.3.7.8Patched before disclosure
1 Nov 2023Drag and Drop Multiple File Upload - Contact Form 7 <= 1.3.7.3 - Unauthenticated Arbitrary File Upload8.1<= 1.3.7.31.3.7.464
24 Feb 2023Drag and Drop Multiple File Upload - Contact Form 7 <= 1.3.6.5 - Cross-Site Request Forgery in dnd_upload_cf7_upload and dnd_codedropz_upload_delete8.8<= 1.3.6.51.3.6.64
26 Sep 2022Drag and Drop Multiple File Upload - Contact Form 7 <= 1.3.6.4 - File Upload Size Limit Bypass5.3<= 1.3.6.41.3.6.5152
7 Mar 2022Drag and Drop Multiple File Upload - Contact Form 7 <= 1.3.6.2 - Unauthenticated Stored Cross-Site Scripting7.2<= 1.3.6.21.3.6.3108
4 Jun 2020Drag and Drop Multiple File Upload - Contact Form 7 <= 1.3.3.2 - Arbitrary File Upload9.8<= 1.3.3.21.3.3.3n/a

Changelog mentions of security fixes: 1.3.9.8 (security, vulnerability, XSS, escaping, sanitize); 1.3.9.9 (security, vulnerability, XSS, nonce); 1.4.1 (security).

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

100% of 2 support threads resolved in the last 2 months.

Momentum

60,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Drag and Drop Multiple File Upload for
4 May 2026798
11 May 20262,738
18 May 20263,988
25 May 202619,481
1 Jun 20265,641
8 Jun 20263,720
15 Jun 20262,825
22 Jun 20262,331
29 Jun 20262,172
6 Jul 20263,500
13 Jul 20261,901
20 Jul 20262,177
27 Jul 20261,975
3 Aug 20261,912
10 Aug 20261,875
17 Aug 202621,380
24 Aug 20266,379
31 Aug 202620,039
7 Sep 20265,065
14 Sep 20265,068
21 Sep 20263,989
28 Sep 20263,312
5 Oct 20262,984
12 Oct 20262,660
19 Oct 20263,967
26 Oct 202617,993
2 Nov 20262,170

Weekly downloads over the last 4 weeks are 19% above the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

Image CAPTCHA for Contact Form 7 andScore 100 · 70,000+Gravity Forms CLI Add-OnScore 100 · 20,000+CF7 MateScore 100 · 20,000+Fluent PDF GeneratorScore 100 · 20,000+Successful Redirection for Contact FormScore 100 · 10,000+

Facts

Version1.4.1
AuthorGlen Don Mongaya
Added4 Dec 2018
Last updated30 Oct 2026
Active installs60,000+
Requires WordPress3.0.1
Tested up to7.0.8
Requires PHP5.2.4
CategoryForms & Data Collection > Form Builders & Creators
Tagsupload, ajax uploader, drag-and-drop, multiple file, contact form 7

Other plugins by this author: Drag and Drop Multiple File Upload for WooCommerce, Easy File Upload & Approval - A Simple File Submission & Review System, Profile Directory - Filter

Questions

Is Drag and Drop Multiple File Upload for still maintained?

Yes. Last release 30 Oct 2026, 18 releases in the last 24 months.

Who owns Drag and Drop Multiple File Upload for, and has it changed hands?

No change recorded. Main committer glenwpcoder since Dec 2018.

Was Drag and Drop Multiple File Upload for removed from wordpress.org?

No. Listed on wordpress.org as of 4 Nov 2026.

Is Drag and Drop Multiple File Upload for safe?

20 known vulnerabilities, all fixed (latest in 1.3.9.9). Not on the exploited list.

Is the latest Drag and Drop Multiple File Upload for update safe to install?

No ownership change before 1.4.1. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 4 Nov 2026.Report a data issue