CVE-2026-123460: high-severity vulnerability in Nickboss WordPress File Upload
WordPress WordPress File Upload plugin <= 5.2.2 - Cross Site Scripting (XSS) vulnerability
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
18Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File Upload wp-file-upload allows Stored XSS.This issue affects WordPress File Upload: from n/a through 5.2.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Affected products
Nickboss · WordPress File UploadRelated CVEs — Nickboss WordPress File Upload
In the same product, most dangerous first.