WP-FILE-UPLOAD · CVE-2026-123460 · Other
FIX → 5.2.3
The wp-file-upload plugin for WordPress through version 5.2.2 fails to neutralize input, allowing stored cross-site scripting. An attacker can plant script that runs in the browser of anyone who views the affected page.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the wp-file-upload plugin at version 5.2.2 or earlier are exposed. The flaw is stored XSS, so the risk applies wherever the plugin's uploaded or submitted content is displayed to other users, including administrators. Sites without the plugin installed are not affected.
Not affected if plugin-not-installed
Who cares self-hosted, wordpress, wp-file-upload
5.2.2 or earlier is in the affected range5.2.3 or laterUpgrade to 5.2.3
5.2.3 or later5.2.3 changelog fixes a Patchstack-reported bypass of the HTML-content upload protection added in ; it does not cite this CVE, so the match is likely but not confirmedPosts are quoted with a link to the original. They are data to us, never instructions.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File Upload wp-file-upload allows Stored XSS.This issue affects WordPress File Upload: from n/a through 5.2.2.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
5.2.2