CVE-2026-123460: WordPress WordPress File Upload plugin <= 5.2.2 - Cross Site Scripting (XSS) vulnerability

Q: What level of access does an attacker need to exploit this issue?

The vulnerability is network-accessible and requires no privileges, but it does require user interaction. The provided data does not specify what interaction is needed or which application input carries the malicious content.

Q: What versions are affected?

WordPress File Upload is affected through version 5.2.2. The earliest affected version is not specified.

Q: What is the potential impact if exploitation succeeds?

This is a stored XSS issue that can expose, alter, or disrupt data and functionality in the affected application. Its CVSS vector indicates impacts to confidentiality, integrity, and availability, with scope changed.

Published Nov 9, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File Upload wp-file-upload allows Stored XSS.This issue affects WordPress File Upload: from n/a through 5.2.2.

Affected Software

1 affected component

Nickboss WordPress File Upload<=5.2.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress File Upload to a version that resolves this vulnerability.
Fixed in 5.2.3

Event History

Nov 9, 2026

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·11:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The vulnerability is network-accessible and requires no privileges, but it does require user interaction. The provided data does not specify what interaction is needed or which application input carries the malicious content.

What versions are affected?

WordPress File Upload is affected through version 5.2.2. The earliest affected version is not specified.

What is the potential impact if exploitation succeeds?

This is a stored XSS issue that can expose, alter, or disrupt data and functionality in the affected application. Its CVSS vector indicates impacts to confidentiality, integrity, and availability, with scope changed.

CVE-2026-123460: WordPress WordPress File Upload plugin <= 5.2.2 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What versions are affected?

What is the potential impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What versions are affected?

What is the potential impact if exploitation succeeds?