WordPress File Upload vulnerabilities

3 known CVE vulnerabilities in WordPress File Upload, translated and rated.

CVE-2026-62071Critical
The WordPress File Upload plugin in versions up to and including 5.1.10 contains an SQL injection vulnerability exploitable by an unauthenticated attacker.
CVE-2026-66447Critical
The WordPress File Upload plugin versions up to 5.1.7 contain an Unauthenticated SQL Injection vulnerability. A remote unauthenticated attacker can execute malicious SQL queries against the database.
CVE-2026-66570High
The WordPress File Upload plugin (Nickboss) contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions up to and including 5.2.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS