{"id":"CVE-2026-123460","kind":"vulnerability","aliases":["CVE-2026-123460"],"related":[],"title":"WordPress File Upload plugin: stored XSS through uploaded content","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File Upload wp-file-upload allows Stored XSS.This issue affects WordPress File Upload: from n/a through 5.2.2.","summary":"The wp-file-upload plugin for WordPress through version 5.2.2 fails to neutralize input, allowing stored cross-site scripting. An attacker can plant script that runs in the browser of anyone who views the affected page.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"wp-file-upload","fixed":["5.2.3"],"affected":"<= 5.2.2","ecosystem":"wordpress"}],"ecosystems":[],"tags":["other","self-hosted","wordpress","wp-file-upload"],"not_affected_if":["plugin-not-installed"],"how_to_check":"In WordPress admin under Plugins, check the WordPress File Upload version; 5.2.2 or earlier is in the affected range. Or read the Version header in wp-content/plugins/wp-file-upload/wp-file-upload.php. Upgrade to 5.2.3 or later.","fix":"Update WordPress File Upload (wp-file-upload) to 5.2.3 or later. The 5.2.3 changelog fixes a Patchstack-reported bypass of the HTML-content upload protection added in 5.2.2; it does not cite this CVE, so the match is likely but not confirmed.","status":"open","published_at":"2026-11-09T11:17:23+00:00","first_seen_at":"2026-11-09T11:26:03+00:00","triaged_at":"2026-11-09T11:26:33+00:00","updated_at":"2026-11-09T11:28:03+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-09T11:26:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress File Upload plugin: stored XSS through uploaded content","impact":"medium","summary":"The wp-file-upload plugin for WordPress through version 5.2.2 fails to neutralize input, allowing stored cross-site scripting. An attacker can plant script that runs in the browser of anyone who views the affected page.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","wp-file-upload","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in visitors' and admins' browsers on the site","analyst_note":"Sources give no fixed version and no details on the upload path or required privileges; check the vendor plugin page or the NVD entry for a patched release.","how_to_check":"- Check the installed version of the WordPress File Upload plugin (wp-file-upload) in the WordPress admin under Plugins, or in `wp-content/plugins/wp-file-upload/`.\n- Confirm whether the installed version is 5.2.2 or earlier.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the wp-file-upload plugin at version 5.2.2 or earlier are exposed. The flaw is stored XSS, so the risk applies wherever the plugin's uploaded or submitted content is displayed to other users, including administrators. Sites without the plugin installed are not affected.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000739,"input_tokens":4550,"output_tokens":568,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources give no fixed version and no details on the upload path or required privileges; check the vendor plugin page or the NVD entry for a patched release.","search":"'-123460':12A,15A '-2026':11A,14A '5.2.2':39B,100C 'affect':65B,93C 'allow':44B,89C 'anyon':61B 'attack':51B 'browser':59B 'content':9A 'cross':47B,76C 'cross-sit':46B,75C 'cve':10A,13A 'fail':40B 'file':2A,18A,27B,32B,83C,87C,95C 'generat':74C 'host':23B 'improp':67C 'input':43B,70C 'issu':92C 'n/a':98C 'neutral':42B,68C 'nickboss':81C 'page':66B,73C 'plant':53B 'plugin':4A,34B 'run':56B 'script':49B,54B,78C 'self':22B 'self-host':21B 'site':48B,77C 'store':5A,45B,90C 'upload':3A,8A,19A,28B,33B,84C,88C,96C 'version':38B 'view':63B 'vulner':79C 'web':72C 'wordpress':1A,24B,36B,82C,94C 'wp':17A,26B,31B,86C 'wp-file-upload':16A,25B,30B,85C 'xss':6A 'xss.this':91C","nicknames":[],"mitigations":[],"who_affected":"Sites running the wp-file-upload plugin at version 5.2.2 or earlier are exposed. The flaw is stored XSS, so the risk applies wherever the plugin's uploaded or submitted content is displayed to other users, including administrators. Sites without the plugin installed are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["wpfileupload"],"ptokens":["file","upload","wp"],"labels":["high","other","selfhosted","wordpress","wpfileupload"],"campaign_type":null,"search_a":"'-123460':12A,15A '-2026':11A,14A 'content':9A 'cve':10A,13A 'file':2A,18A 'plugin':4A 'store':5A 'upload':3A,8A,19A 'wordpress':1A 'wp':17A 'wp-file-upload':16A 'xss':6A","search_b":"'5.2.2':39B 'affect':65B 'allow':44B 'anyon':61B 'attack':51B 'browser':59B 'cross':47B 'cross-sit':46B 'fail':40B 'file':27B,32B 'host':23B 'input':43B 'neutral':42B 'page':66B 'plant':53B 'plugin':34B 'run':56B 'script':49B,54B 'self':22B 'self-host':21B 'site':48B 'store':45B 'upload':28B,33B 'version':38B 'view':63B 'wordpress':24B,36B 'wp':26B,31B 'wp-file-upload':25B,30B","search_c":"'5.2.2':100C 'affect':93C 'allow':89C 'cross':76C 'cross-sit':75C 'file':83C,87C,95C 'generat':74C 'improp':67C 'input':70C 'issu':92C 'n/a':98C 'neutral':68C 'nickboss':81C 'page':73C 'script':78C 'site':77C 'store':90C 'upload':84C,88C,96C 'vulner':79C 'web':72C 'wordpress':82C,94C 'wp':86C 'wp-file-upload':85C 'xss.this':91C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T11:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123460","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123460","severity":null,"published_at":"2026-11-09T11:17:23+00:00","modified_at":"2026-11-09T11:17:23+00:00","first_seen_at":"2026-11-09T11:26:03+00:00","fetched_at":"2026-11-09T11:26:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123460:2275","url":"https://wordpress.org/plugins/wp-file-upload/","severity":null,"published_at":"2026-11-09T11:28:03+00:00","modified_at":"2026-11-09T11:28:03+00:00","first_seen_at":"2026-11-09T11:28:03+00:00","fetched_at":"2026-11-09T11:28:03+00:00","note":"NVD gives range through 5.2.2 (Patchstack CVSS 7.1, PR:N, UI:R). wordpress.org changelog: 5.2.3 (Nov 2026) fixes Patchstack-reported bypass of HTML upload protection (tag ending in slash instead of space). It does not name the CVE or say XSS, so fix is likely and left unverified. Privileges and upload path come from NVD only (PR:N). web-cli had no Exa credits; the Patchstack page 404'd. No exploitation or PoC found; X not searched.","cites":["https://wordpress.org/plugins/wp-file-upload/","https://nvd.nist.gov/vuln/detail/CVE-2026-123460"]}],"documents":[{"id":107190,"url":"https://wordpress.org/plugins/wp-file-upload/","title":"WordPress File Upload plugin page and changelog (5.2.3)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":107191,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123460","title":"NVD CVE-2026-123460","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}