---
id: "CVE-2026-123460"
page: "https://infrastack.ai/live/CVE-2026-123460"
kind: "vulnerability"
aliases: ["CVE-2026-123460"]
title: "WordPress File Upload plugin: stored XSS through uploaded content"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "wp-file-upload", "fixed": ["5.2.3"], "affected": "<= 5.2.2", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["other", "self-hosted", "wordpress", "wp-file-upload"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-09T11:17:23+00:00"
first_seen_at: "2026-11-09T11:26:03+00:00"
updated_at: "2026-11-09T11:28:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123460", "first_seen_at": "2026-11-09T11:26:03+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123460", "first_seen_at": "2026-11-09T11:28:03+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-123460", "https://wordpress.org/plugins/wp-file-upload/"]}]
exploit_sources: []
---

# WordPress File Upload plugin: stored XSS through uploaded content

Link for people: https://infrastack.ai/live/CVE-2026-123460 (this .md is for agents)

The wp-file-upload plugin for WordPress through version 5.2.2 fails to neutralize input, allowing stored cross-site scripting. An attacker can plant script that runs in the browser of anyone who views the affected page.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:wp-file-upload affected <= 5.2.2 fixed 5.2.3

## How to check

In WordPress admin under Plugins, check the WordPress File Upload version; 5.2.2 or earlier is in the affected range. Or read the Version header in wp-content/plugins/wp-file-upload/wp-file-upload.php. Upgrade to 5.2.3 or later.

## Fix

Update WordPress File Upload (wp-file-upload) to 5.2.3 or later. The 5.2.3 changelog fixes a Patchstack-reported bypass of the HTML-content upload protection added in 5.2.2; it does not cite this CVE, so the match is likely but not confirmed.

## Timeline

- 2026-11-09T11:26:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123460
- 2026-11-09T11:28:03+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-123460 — NVD gives range through 5.2.2 (Patchstack CVSS 7.1, PR:N, UI:R). wordpress.org changelog: 5.2.3 (Nov 2026) fixes Patchstack-reported bypass of HTML upload protection (tag ending in slash instead of space). It does not name the CVE or say XSS, so fix is likely and left unverified. Privileges and upload path come from NVD only (PR:N). web-cli had no Exa credits; the Patchstack page 404'd. No exploitation or PoC found; X not searched.

## Documents

- [describes] NVD CVE-2026-123460 https://nvd.nist.gov/vuln/detail/CVE-2026-123460
- [fix] WordPress File Upload plugin page and changelog (5.2.3) https://wordpress.org/plugins/wp-file-upload/

## From the sources

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File Upload wp-file-upload allows Stored XSS.This issue affects WordPress File Upload: from n/a through 5.2.2.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_