File Upload Types by WPForms
File Upload Types by WPForms has one disclosed vulnerability in the WordSec catalog, all reported in 2024; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for File Upload Types by WPForms has a vendor fix available, so running the current release closes it.
All of these findings were reported by Francesco Carlucci. File Upload Types by WPForms is installed on roughly 40,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2024-10016File Upload Types by WPForms <= 1.4.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Read the full analysisVulnerability Records

File Upload Types by WPForms
Author
Syed Balkhi
WordPress File Upload Types Plugin Do you want to let your WordPress website accept uploads from your users for more file types and to freely upload files? We created the File Upload Types plugin to make it simple for anyone to easily add support for any file types with any extension or MIME type. How WordPress File Uploads Work By default, WordPress only allows certain file types to be uploaded to your website’s media library. If someone tries to upload a file type outside of these whitelisted WordPress file extensions, this can be the cause of the common WordPress error Sorry, this file type is not permitted for security reasons message. It can be frustrating if you’ve created a file upload form in WordPress but the file type you want to accept is a file extension that’s not allowed. This plugin lets your website upload more file types beyond the limited file extension types that WordPress allows by default. How does the File Upload Types plugin work? The File Upload Types plugin works by letting you adjust the internal file whitelist, letting you manually control which types of file extensions your WordPress website can upload. This way, you can accept any file type through your website and/or any contact form plugin like WPForms. What file types can I upload to WordPress with this plugin? The File Upload Types plugin lets you allow uploads of any file extension, including custom file types. Some common file extension types this plugin lets you add that WordPress doesn’t support natively include: .ai .zip .xml .svg .csv .mobi .cad .dwg .dxf …and any other file extensions that exist, including custom file types. We hope that you find the File Upload Types plugin helpful! Credits This plugin was created by the team behind WPForms – the best drag & drop form builder for WordPress. What’s Next If you like this plugin, then consider checking out our other projects: WPForms – The best WordPress Contact Form Plugin. OptinMonster – Get more email subscribers with the most popular conversion optimization plugin for WordPress. MonsterInsights – See the stats that matter and grow your business with confidence. Best Google Analytics plugin for WordPress. SeedProd – Jumpstart your website with the #1 Coming Soon & Maintenance Mode plugin for WordPress. WP Mail SMTP – Improve email deliverability for your contact form with the most popular SMTP plugin for WordPress. RafflePress – The Best WordPress giveaway and contest plugin. Visit WPBeginner to learn from our WordPress tutorials and find out about other best WordPress plugins.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C