CVE-2026-66570
Stored XSS in WordPress File Upload wp-file-upload before 5.2.1
- CVSS 3.1
- 7.1 high
- EPSS
- —
- Published
- ·
- Modified
Stored XSS in WordPress File Upload wp-file-upload allows improper neutralization of input during web page generation. Attackers trigger it by submitting malicious payloads through the plugin with user interaction. This gives code execution in victim browsers. Affected are all users of versions through 5.2.1.
What to do: Apply Nickboss's update for CVE-2026-66570. Fixed version not stated.
| Product | Affected |
|---|---|
| Nickboss WordPress File Upload | — |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File Upload wp-file-upload allows Stored XSS.This issue affects WordPress File Upload: from n/a through 5.2.1.
- Ecosystems
- WordPress
- Weakness
- CWE-79
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
In the news
0 storiesNo ingested article mentions this CVE yet.