Drag and Drop Multiple File Upload for Contact Form 7

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 100% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. The recent download trend is too spiky to read.

Reviewers keep calling it the file upload piece Contact Form 7 is missing, with fast developer support and easy setup, though one user couldn't get uploads to work at all.

1. ★★★★★ briabbott

   6mo ago

   This plugin (Pro version) has a number of useful features that a client was looking for. More importantly, I required support on two occasions during initial set-up and testing and Glen was fast to reply and able to sort everything out both times.

   Read on wp.org ↗
2. ★★★★★ waazdakka

   6mo ago

   Just perfect for the need, perfect integration

   Read on wp.org ↗
3. ★★★★★ nicolaettore

   7mo ago

   This is an outstanding plugin for managing attachments in Contact Form 7. The interface is intuitive and straightforward, making it incredibly easy to implement even for those who aren’t deeply technical.What impressed me most is that the free version already delivers solid, reliable results right out of the box—no need to upgrade just to get basic functionality working properly.Clean, functional, and does exactly what it promises. Highly recommended for anyone working with CF7 who needs a dependable attachment solution.

   Read on wp.org ↗
4. ★★★★★ MarkJ

   12mo ago

   Working good This topic was modified 10 months, 2 weeks ago by MarkJ.

   Read on wp.org ↗
5. ★★★★★ floridafarmswaps

   1.1y ago

   I have followed the instructions and have tried to upload several times but nothing is uploaded but my form works ok.

   Read on wp.org ↗
6. ★★★★★ yodastudio

   1.5y ago

   Contact Form 7 is great plugin but it misses a basic function: file uploading.Now you can have it with this nice plugin, very useful e simple to use. Free version offers enough options for basic contact forms.Compatible with WPML plugin. This topic was modified 1 year, 5 months ago by yodastudio.

   Read on wp.org ↗
7. ★★★★★ larsactionhero

   2.2y ago

   Like said in the title: works like a charm.Then only thing is that it still uses jQuery which is absolutely not necessary in these days.I’d love to rewrite it to vanilla javascript which seems not to be very complicated. This topic was modified 2 years ago by larsactionhero.

   Read on wp.org ↗
8. ★★★★★ rozuja

   2.6y ago

   Perfect plugin. Works a charm. Not hazzle in setting it its allmost straight foward. U can keep your uploaded PDF files. U can send them as an attachment link, just add the CF7 shortcode that add on the pannel and your good to go. Plugin tells you the upload progress and disables the send button, pus has a drag an drop function thats cool. Well done.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 1.3.9.8 Bug Fix – Js error disabled button after upload when “enable jquery” option is used. Security Fix – Cross Site Scripting (XSS) (via patchstack) Security Fix – Fixed Unauthenticated Arbitrary File Upload (Thanks to “Nguye 1.3.9.8
2. — Version 1.3.9.7 Improved : Change htacess generated file to support apache 2.2 & 2.4 Security Fix : Unauthenticated Arbitrary File Upload via Non-ASCII Filename Blacklist (Thanks to Leonid Semenenko via WordFence) Security Fix : Unauthe 1.3.9.7
3. — Version 1.3.9.6 New : Replaced cookies with localStorage for unique upload folder generation. Security : Unauthenticated Arbitrary File Upload (Reported by Thomas Sanzey via WordFence) – user able to upload “php5 – php8” for non ascii f 1.3.9.6
4. — Version 1.3.9.5 Hot Fix: Minor spelling mistakes. 1.3.9.5
5. — Version 1.3.9.4 Fixes: Change shutdown hook to cron events in order to fix this issue. Support Link Fixes: Move the js cookie generation from wp_footer hook to wp_add_inline_script. Support Link Improvement: Minor fixes and improvement. 1.3.9.4
6. — Version 1.3.9.3 Security: Fixed vulnerability issues reported by WordFence (reported by shark3y) – unauthorized modification of data due to a missing ownership check in the dnd_codedropz_upload_delete() function. Security: Fixed an unau 1.3.9.3

20 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Critical · 9.8 Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Unauthenticated Remote Code Execution ↗
   2026-08-24 CVE-2026-18781 Improper Control of Generation of Code ('Code Injection') Affects < 1.3.9.9 Patched in 1.3.9.9
2. Medium · 4.4 Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
   2026-08-24 CVE-2026-14325 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 1.3.9.9 Patched in 1.3.9.9
3. Medium · 4.4 Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'drag_n_drop_text' and 'drag_n_drop_browse_text' Settings ↗
   2026-06-05 CVE-2026-8991 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.3.9.7 Patched in 1.3.9.8
4. High · 7.2 Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Unauthenticated Stored Cross-Site Scripting ↗
   2026-06-03 CVE-2026-49055 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.3.9.7 Patched in 1.3.9.8
5. High · 8.1 Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Unauthenticated Arbitrary File Upload via Non-ASCII Filename Blacklist Bypass ↗
   2026-04-17 CVE-2026-5718 Unrestricted Upload of File with Dangerous Type Affects <= 1.3.9.7 Patched in 1.3.9.8
6. High · 7.5 Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.6 - Unauthenticated Limited Arbitrary File Read via mfile Field ↗
   2026-04-17 CVE-2026-5710 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 1.3.9.6 Patched in 1.3.9.7
7. High · 8.1 Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.5 - Unauthenticated Arbitrary File Upload ↗
   2026-03-05 CVE-2026-3459 Unrestricted Upload of File with Dangerous Type Affects <= 1.3.9.5 Patched in 1.3.9.6
8. Low · 3.7 Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.2 - Missing Authorization to Unauthenticated File Deletion ↗
   2026-01-14 CVE-2025-14457 Missing Authorization Affects <= 1.3.9.2 Patched in 1.3.9.3
9. Medium · 6.1 Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.9.2 - Unauthenticated Limited Arbitrary File Upload ↗
   2026-01-06 CVE-2025-14842 Unrestricted Upload of File with Dangerous Type Affects <= 1.3.9.2 Patched in 1.3.9.3
10. Medium · 5.3 Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.0 - Directory Traversal via `wpcf7_guest_user_id` Cookie ↗
    2025-08-15 CVE-2025-8464 Relative Path Traversal Affects <= 1.3.9.0 Patched in 1.3.9.1
11. High · 8.1 Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.9 - Unauthenticated Arbitrary File Upload via Insufficient Blacklist Checks ↗
    2025-06-16 CVE-2025-3515 Unrestricted Upload of File with Dangerous Type Affects <= 1.3.8.9 Patched in 1.3.9.0
12. High · 8.8 Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.7 - Unauthenticated Arbitrary File Deletion ↗
    2025-03-27 CVE-2025-2328 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 1.3.8.7 Patched in 1.3.8.8
13. High · 7.5 Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.7 - Unauthenticated PHP Object Injection via PHAR to Arbitrary File Deletion ↗
    2025-03-27 CVE-2025-2485 Deserialization of Untrusted Data Affects <= 1.3.8.8 Patched in 1.3.8.9
14. Medium · 5.3 Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.8.5 - Limited Arbitrary File Deletion ↗
    2025-01-30 CVE-2024-12267 External Control of File Name or Path Affects <= 1.3.8.5 Patched in 1.3.8.6
15. Medium · 5.3 Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.7.7 - Sensitive Information Exposure ↗
    2024-04-29 CVE-2024-3717 Insecure Storage of Sensitive Information Affects <= 1.3.7.7 Patched in 1.3.7.8
16. High · 8.1 Drag and Drop Multiple File Upload - Contact Form 7 <= 1.3.7.3 - Unauthenticated Arbitrary File Upload ↗
    2023-11-01 CVE-2023-5822 Unrestricted Upload of File with Dangerous Type Affects <= 1.3.7.3 Patched in 1.3.7.4
17. High · 8.8 Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.6.5 - Cross-Site Request Forgery in dnd_upload_cf7_upload and dnd_codedropz_upload_delete ↗
    2023-02-24 CVE-2022-45364 Cross-Site Request Forgery (CSRF) Affects <= 1.3.6.5 Patched in 1.3.6.6
18. Medium · 5.3 Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.6.4 - File Upload Size Limit Bypass ↗
    2022-09-26 CVE-2022-3282 Authorization Bypass Through User-Controlled Key Affects <= 1.3.6.4 Patched in 1.3.6.5
19. High · 7.2 Drag and Drop Multiple File Upload - Contact Form 7 <= 1.3.6.2 - Unauthenticated Stored Cross-Site Scripting ↗
    2022-03-07 CVE-2022-0595 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.3.6.2 Patched in 1.3.6.3
20. Critical · 9.8 Drag and Drop Multiple File Upload - Contact Form 7 <= 1.3.3.2 - Arbitrary File Upload ↗
    2020-06-04 CVE-2020-12800 Unrestricted Upload of File with Dangerous Type Affects <= 1.3.3.2 Patched in 1.3.3.3

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 16 languages, 2 at 90% or more

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2024-03-21 50K+ → 60K+ up

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Drag and Drop Multiple File Upload for WooCommerce 5K+ installs · 4.5★ · 4 shared tags A
• Images Optimize and Upload CF7 600+ installs · 4.4★ · 3 shared tags A
• Elementor Website Builder – more than just a page builder 10M+ installs · 4.5★ · 1 shared tag A
• Database Addon for Contact Form 7 – CFDB7 600K+ installs · 5.0★ · 1 shared tag A
• Kirki – Freeform Page Builder, Website Builder & Customizer 500K+ installs · 4.4★ · 1 shared tag B
• Page Builder by SiteOrigin 400K+ installs · 4.8★ · 1 shared tag A

Embed this report card

Drop a live Pulse card for Drag and Drop Multiple File Upload for Contact Form 7 into a readme, a review or a deck. It updates itself.

Drag and Drop Multiple File Upload for Contact Form 7: 60K+ active installs, 4.8★ (94 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/drag-and-drop-multiple-file-upload-contact-form-7