Live › vulnerability › CVE-2026-66570
The wp-file-upload WordPress plugin by Nickboss has a stored cross-site scripting flaw in versions up to 5.2.1. An attacker who can get script stored in the site can run it in other visitors' browsers, including administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 16:20 UTC. All times on this page are UTC.
Sites running the wp-file-upload WordPress plugin at version 5.2.1 or earlier are affected. Sites without the plugin, or running a newer version, can skip it. The sources do not say what configuration or account level is needed to store the script.
No product ranges from the sources yet.
5.2.1 (the sources do not name a specific fixed version).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File Upload wp-file-upload allows Stored XSS.This issue affects WordPress File Upload: from n/a through 5.2.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-66570")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.