WordPress security by component
Multi Uploader for Gravity Forms
Plugin description
Multi Uploader for Gravity Forms is a WordPress component with 2 published CVE records in this archive. The latest tracked vulnerability was published Dec 12, 2025; the highest CVE/CNA score is 9.8.
Plugin slug:
gf-multi-uploaderLatest vulnerability
CVE-2025-14344: Multi Uploader for Gravity Forms: Arbitrary file deletion
Multi Uploader for Gravity Forms is affected by arbitrary file deletion. The vulnerable path is reachable without authentication. A successful request can remove files outside the intended scope and may make the site unavailable.
| Safe version |
|
||
|---|---|---|---|
| Dec 12, 2025 |
CVE-2025-14344
Multi Uploader for Gravity Forms: Arbitrary file deletion
Multi Uploader for Gravity Forms is affected by arbitrary file deletion. The vulnerable path is reachable without authentication. A successful request can remove files outside the intended scope and may make the site unavailable.
|
See mitigation notes |
CVE9.8
NVDPending
|
| Jan 22, 2025 |
CVE-2025-23921
Multi Uploader for Gravity Forms: Dangerous file upload
Multi Uploader for Gravity Forms is affected by dangerous file upload. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.
|
See mitigation notes |
CVE9.0
NVDPending
|