Nickboss WordPress File Upload: Stored Cross-Site Scripting (CVE-2026-66570)
The Nickboss WordPress File Upload plugin (up to version 5.2.1) is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation.
CVE search metadata
CVE search record: CVE-2026-66570. Severity: high. CVSS: 7.1. KEV: no. Product: WordPress File Upload (n/a through 5.2.1). Brief: Nickboss WordPress File Upload: Stored Cross-Site Scripting (CVE-2026-66570). Brief link: https://feed.craftedsignal.io/briefs/2026-11-wordpress-file-upload-xss/
Triage facts
Revision 1- Applicability
- WordPress File Upload (n/a through 5.2.1)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 1, 16:57 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The WordPress File Upload plugin (wp-file-upload) by Nickboss is affected by a Stored Cross-Site Scripting (XSS) vulnerability, tracked as CVE-2026-66570. This issue is caused by the improper neutralization of input during web page generation and affects the plugin from version n/a through 5.2.1.