Drag and Drop Multiple File Upload for Contact Form 7

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

444 searches this plugin appeared in over the last 90 days, 20 listed. 326 left out as unrelated or noise (years, numbers, stray words).

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 2.6 years ago; the previous band took 19 months to cross, which places it about 80% of the way through.

1. ★★★★★ briabbott

   9mo ago

   This plugin (Pro version) has a number of useful features that a client was looking for. More importantly, I required support on two occasions during initial set-up and testing and Glen was fast to reply and able to sort everything out both times.

   Read on wp.org ↗
2. ★★★★★ waazdakka

   9mo ago

   Just perfect for the need, perfect integration

   Read on wp.org ↗
3. ★★★★★ nicolaettore

   10mo ago

   This is an outstanding plugin for managing attachments in Contact Form 7. The interface is intuitive and straightforward, making it incredibly easy to implement even for those who aren’t deeply technical.What impressed me most is that the free version already delivers solid, reliable results right out of the box—no need to upgrade just to get basic functionality working properly.Clean, functional, and does exactly what it promises. Highly recommended for anyone working with CF7 who needs a dependable attachment solution.

   Read on wp.org ↗
4. ★★★★★ MarkJ

   1.2y ago

   Working good This topic was modified 10 months, 2 weeks ago by MarkJ.

   Read on wp.org ↗
5. ★★★★★ floridafarmswaps

   1.3y ago

   I have followed the instructions and have tried to upload several times but nothing is uploaded but my form works ok.

   Read on wp.org ↗
6. ★★★★★ yodastudio

   1.7y ago

   Contact Form 7 is great plugin but it misses a basic function: file uploading.Now you can have it with this nice plugin, very useful e simple to use. Free version offers enough options for basic contact forms.Compatible with WPML plugin. This topic was modified 1 year, 5 months ago by yodastudio.

   Read on wp.org ↗
7. ★★★★★ larsactionhero

   2.4y ago

   Like said in the title: works like a charm.Then only thing is that it still uses jQuery which is absolutely not necessary in these days.I’d love to rewrite it to vanilla javascript which seems not to be very complicated. This topic was modified 2 years ago by larsactionhero.

   Read on wp.org ↗
8. ★★★★★ rozuja

   2.8y ago

   Perfect plugin. Works a charm. Not hazzle in setting it its allmost straight foward. U can keep your uploaded PDF files. U can send them as an attachment link, just add the CF7 shortcode that add on the pannel and your good to go. Plugin tells you the upload progress and disables the send button, pus has a drag an drop function thats cool. Well done.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 1.3.9.8 Bug Fix – Js error disabled button after upload when “enable jquery” option is used. Security Fix – Cross Site Scripting (XSS) (via patchstack) Security Fix – Fixed Unauthenticated Arbitrary File Upload (Thanks to “Nguye 1.3.9.8
2. — Version 1.3.9.7 Improved : Change htacess generated file to support apache 2.2 & 2.4 Security Fix : Unauthenticated Arbitrary File Upload via Non-ASCII Filename Blacklist (Thanks to Leonid Semenenko via WordFence) Security Fix : Unauthe 1.3.9.7
3. — Version 1.3.9.6 New : Replaced cookies with localStorage for unique upload folder generation. Security : Unauthenticated Arbitrary File Upload (Reported by Thomas Sanzey via WordFence) – user able to upload “php5 – php8” for non ascii f 1.3.9.6
4. — Version 1.3.9.5 Hot Fix: Minor spelling mistakes. 1.3.9.5
5. — Version 1.3.9.4 Fixes: Change shutdown hook to cron events in order to fix this issue. Support Link Fixes: Move the js cookie generation from wp_footer hook to wp_add_inline_script. Support Link Improvement: Minor fixes and improvement. 1.3.9.4
6. — Version 1.3.9.3 Security: Fixed vulnerability issues reported by WordFence (reported by shark3y) – unauthorized modification of data due to a missing ownership check in the dnd_codedropz_upload_delete() function. Security: Fixed an unau 1.3.9.3

All 20 disclosed vulnerabilities are patched in the current version (1.4.1). Sites still on an older version should update.

1. Patched Critical · 9.8 Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Unauthenticated Remote Code Execution ↗
   2026-08-24 CVE-2026-18781 Improper Control of Generation of Code Affects < 1.3.9.9 Patched in 1.3.9.9
2. Patched Medium · 4.4 Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
   2026-08-24 CVE-2026-14325 Improper Neutralization of Input During Web Page Generation Affects < 1.3.9.9 Patched in 1.3.9.9
3. Patched Medium · 4.4 Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'drag_n_drop_text' and 'drag_n_drop_browse_text' Settings ↗
   2026-06-05 CVE-2026-8991 Improper Neutralization of Input During Web Page Generation Affects <= 1.3.9.7 Patched in 1.3.9.8
4. Patched High · 7.2 Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Unauthenticated Stored Cross-Site Scripting ↗
   2026-06-03 CVE-2026-49055 Improper Neutralization of Input During Web Page Generation Affects <= 1.3.9.7 Patched in 1.3.9.8
5. Patched High · 8.1 Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Unauthenticated Arbitrary File Upload via Non-ASCII Filename Blacklist Bypass ↗
   2026-04-17 CVE-2026-5718 Unrestricted Upload of File with Dangerous Type Affects <= 1.3.9.7 Patched in 1.3.9.8
6. Patched High · 7.5 Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.6 - Unauthenticated Limited Arbitrary File Read via mfile Field ↗
   2026-04-17 CVE-2026-5710 Improper Limitation of a Pathname to a Restricted Directory Affects <= 1.3.9.6 Patched in 1.3.9.7
7. Patched High · 8.1 Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.5 - Unauthenticated Arbitrary File Upload ↗
   2026-03-05 CVE-2026-3459 Unrestricted Upload of File with Dangerous Type Affects <= 1.3.9.5 Patched in 1.3.9.6
8. Patched Low · 3.7 Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.2 - Missing Authorization to Unauthenticated File Deletion ↗
   2026-01-14 CVE-2025-14457 Missing Authorization Affects <= 1.3.9.2 Patched in 1.3.9.3
9. Patched Medium · 6.1 Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.9.2 - Unauthenticated Limited Arbitrary File Upload ↗
   2026-01-06 CVE-2025-14842 Unrestricted Upload of File with Dangerous Type Affects <= 1.3.9.2 Patched in 1.3.9.3
10. Patched Medium · 5.3 Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.0 - Directory Traversal via `wpcf7_guest_user_id` Cookie ↗
    2025-08-15 CVE-2025-8464 Relative Path Traversal Affects <= 1.3.9.0 Patched in 1.3.9.1
11. Patched High · 8.1 Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.9 - Unauthenticated Arbitrary File Upload via Insufficient Blacklist Checks ↗
    2025-06-16 CVE-2025-3515 Unrestricted Upload of File with Dangerous Type Affects <= 1.3.8.9 Patched in 1.3.9.0
12. Patched High · 8.8 Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.7 - Unauthenticated Arbitrary File Deletion ↗
    2025-03-27 CVE-2025-2328 Improper Limitation of a Pathname to a Restricted Directory Affects <= 1.3.8.7 Patched in 1.3.8.8
13. Patched High · 7.5 Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.7 - Unauthenticated PHP Object Injection via PHAR to Arbitrary File Deletion ↗
    2025-03-27 CVE-2025-2485 Deserialization of Untrusted Data Affects <= 1.3.8.8 Patched in 1.3.8.9
14. Patched Medium · 5.3 Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.8.5 - Limited Arbitrary File Deletion ↗
    2025-01-30 CVE-2024-12267 External Control of File Name or Path Affects <= 1.3.8.5 Patched in 1.3.8.6
15. Patched Medium · 5.3 Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.7.7 - Sensitive Information Exposure ↗
    2024-04-29 CVE-2024-3717 Insecure Storage of Sensitive Information Affects <= 1.3.7.7 Patched in 1.3.7.8
16. Patched High · 8.1 Drag and Drop Multiple File Upload - Contact Form 7 <= 1.3.7.3 - Unauthenticated Arbitrary File Upload ↗
    2023-11-01 CVE-2023-5822 Unrestricted Upload of File with Dangerous Type Affects <= 1.3.7.3 Patched in 1.3.7.4
17. Patched High · 8.8 Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.6.5 - Cross-Site Request Forgery in dnd_upload_cf7_upload and dnd_codedropz_upload_delete ↗
    2023-02-24 CVE-2022-45364 Cross-Site Request Forgery Affects <= 1.3.6.5 Patched in 1.3.6.6
18. Patched Medium · 5.3 Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.6.4 - File Upload Size Limit Bypass ↗
    2022-09-26 CVE-2022-3282 Authorization Bypass Through User-Controlled Key Affects <= 1.3.6.4 Patched in 1.3.6.5
19. Patched High · 7.2 Drag and Drop Multiple File Upload - Contact Form 7 <= 1.3.6.2 - Unauthenticated Stored Cross-Site Scripting ↗
    2022-03-07 CVE-2022-0595 Improper Neutralization of Input During Web Page Generation Affects <= 1.3.6.2 Patched in 1.3.6.3
20. Patched Critical · 9.8 Drag and Drop Multiple File Upload - Contact Form 7 <= 1.3.3.2 - Arbitrary File Upload ↗
    2020-06-04 CVE-2020-12800 Unrestricted Upload of File with Dangerous Type Affects <= 1.3.3.2 Patched in 1.3.3.3

Translated into 17 languages, 2 at 90% or more

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2024-03-21 50K+ → 60K+ up after 564 days in tier
2. 2022-09-04 40K+ → 50K+ up after 348 days in tier
3. 2021-09-21 30K+ → 40K+ up after 237 days in tier
4. 2021-01-27 20K+ → 30K+ up after 76 days in tier
5. 2020-11-12 10K+ → 20K+ up after 306 days in tier
6. 2020-01-11 7K+ → 10K+ up

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for Drag and Drop Multiple File Upload for Contact Form 7 into a readme, a review or a deck. It updates itself.

Drag and Drop Multiple File Upload for Contact Form 7: 60K+ active installs, 4.8★ (94 reviews). Plugin Pulse (WP Mayor), as of 2026-11-04. https://plugins.wpmayor.com/plugin/drag-and-drop-multiple-file-upload-contact-form-7