Security Alert Summary
The Nickboss “WordPress File Upload” plugin (wp-file-upload) contains a stored cross-site scripting (XSS) vulnerability that results from improper neutralization of input during web page generation. An attacker can submit data that is later rendered without proper encoding, which can execute script in the context of users who view the affected content.
CVE Details
- CVE ID: CVE-2026-123460
- Affected component: WordPress File Upload (Nickboss), package: wp-file-upload
- Affected versions: from n/a through 5.2.2 (5.2.3 is listed as unaffected)
- Published: November 9, 2026 at 11:17:23 AM (UTC)
- Last modified: November 9, 2026 at 4:17:32 PM (UTC)
- CVSS v3.1: Base score 7.1 – HIGH; vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L - Attack details (from CVSS): Attack Vector: NETWORK; Attack Complexity: LOW; Privileges Required: NONE; User Interaction: REQUIRED; Scope: CHANGED
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: LOW
- Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation)
- SSVC indicators: exploitation: none; automatable: no; technical impact: partial
Technical Details
The published description identifies an “Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)” vulnerability that allows stored XSS. In affected releases through 5.2.2, input submitted to the plugin can be stored and later incorporated into generated pages without adequate escaping or encoding. When a user views the affected page, the stored payload can execute in that user’s browser.
The CVSS data shows the flaw is reachable over the network with no privileges required, but it requires user interaction for the payload to execute (for example, a user viewing the page that contains the stored input). The reported impacts are low to confidentiality, integrity, and availability, consistent with a scoped stored XSS where an attacker can run script in a victim’s browser but does not directly imply full site compromise.
How This Could Impact Your Website
Consider a typical site workflow where multiple people interact with the site: a site owner who installs plugins, internal staff who manage content, and external contractors or contributors who upload files or submit entries. An attacker who can supply a payload that the plugin stores and later renders could cause that payload to run in the browsers of staff or contributors who view the affected page.
- Internal staff or contributors who regularly review uploads or submissions could inadvertently execute malicious scripts, potentially exposing information accessible to their browsers (such as session cookies or content visible on the page).
- Exposed email addresses or other user-visible details could increase the risk of targeted phishing or social engineering against staff or contractors.
- Because the vulnerability requires user interaction, the practical risk depends on who views the affected pages and what sensitive actions are available in their sessions.
If you
re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available (the affected data lists 5.2.3 as unaffected).
- Review and reduce unnecessary user roles, especially accounts with content publishing or review privileges.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce attack surface.
- Monitor site activity and logs for unusual uploads, posts, or account activity that could indicate exploitation attempts.
If you
like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
