CVE-2026-66570
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The WordPress File Upload plugin (Nickboss) contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions up to and including 5.2.1.
Risk Assessment
An attacker can store a malicious script that executes in the browser of an administrator or other users. This may lead to session theft, account takeover, or actions performed on behalf of the victim.
Recommendation
Update the WordPress File Upload plugin to a version newer than 5.2.1. Additionally, consider deploying a Content-Security-Policy header and reviewing user-submitted content.
Other vulnerabilities in WordPress File Upload
See all- CVE-2026-62071Critical
The WordPress File Upload plugin in versions up to and including 5.1.10 contains an SQL injection vulnerability exploitable by an unauthenticated attacker.
- CVE-2026-66447Critical
The WordPress File Upload plugin versions up to 5.1.7 contain an Unauthenticated SQL Injection vulnerability. A remote unauthenticated attacker can execute malicious SQL queries against the database.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File Upload wp-file-upload allows Stored XSS.This issue affects WordPress File Upload: from n/a through 5.2.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS