high7.1
CVE-2026-66570
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File Upload wp-file-upload allows Stor…
Impact
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File Upload wp-file-upload allows Stored XSS.This issue affects WordPress File Upload: from n/a through 5.2.1.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nickboss | WordPress File Upload | through 5.2.1 |
| Unknown | WordPress File Upload | Version 0 ≤5.2.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://patchstack.com/database/wordpress/plugin/wp-file-upload/vulnerability/wordpress-wordpress-file-upload-plugin-5-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
- https://github.com/advisories/GHSA-9jg4-gr2w-m5jg
- https://nvd.nist.gov/vuln/detail/CVE-2026-66570