Cross-Site Scripting Vulnerability in Nickboss WordPress File Upload Plugin
CVE-2026-66570

7.1HIGH

Key Information:

Vendor

WordPress
Status
WordPress File Upload
Vendor
CVE Published:
1 November 2026

What is CVE-2026-66570?

The Nickboss WordPress File Upload plugin has a vulnerability that allows attackers to implement Stored Cross-Site Scripting (XSS). This occurs due to improper neutralization of input during web page generation. Users of versions from n/a to 5.2.1 are at risk, as the flaw can be exploited by injecting malicious scripts, potentially allowing unauthorized access to sensitive information or control over user sessions. Immediate updates are recommended to mitigate the risks associated with this vulnerability.

Affected Version(s)

WordPress File Upload 0 <= 5.2.1

References

https://patchstack.com/database/wordpress/plugin/wp-file-...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

fccsec.dev | Patchstack Bug Bounty Program
.