WordPress File Upload CVE-2026-66570

Exploitation targets the Nickboss WordPress File Upload plugin at versions up to and including 5.2.1; later fixed versions, if any, are not stated in the available sources. The stored XSS requires that attacker-controlled input be persisted by the plugin and then rendered to a victim - per UI:R, a user (typically a site administrator or visitor) must load the affected page for the payload to execute, which is the primary limiting factor. The exact plugin feature, form field, or parameter that accepts the injection is not described in the available sources, so the specific trigger cannot be confirmed; while the CVSS vector lists PR:N (no privileges), the description does not state the required access level, so the unauthenticated nature should be verified with the vendor/Patchstack. The scope-change rating (S:C) reflects that script executes in the victim's browser context rather than only the vulnerable component.

This is a stored cross-site scripting flaw (CWE-79) in the Nickboss 'WordPress File Upload' plugin, versions up to and including 5.2.1, reported by Patchstack and scored CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The CVSS signals indicate a network-reachable, low-complexity issue with a scope change (S:C), but exploitation depends on user interaction (UI:R) - a victim must load the page where the injected script renders - and impact is only partial across confidentiality, integrity and availability (C:L/I:L/A:L), consistent with script execution in a browser session rather than server compromise. No EPSS score was supplied, the vulnerability is NOT listed in CISA KEV, and no proof-of-concept or exploit reference is present (the only reference is the Patchstack database advisory itself). The vuln.today priority is 'this_week', not act_now or emergency. Net assessment: a legitimately exploitable stored XSS worth patching on a normal cycle, but there is no evidence of active exploitation or public exploit code, so this is a moderate-priority item rather than an urgent incident. The PR:N rating implies unauthenticated injection, but the available sources do not describe the exact injection point or whether some privilege level is actually required - verify against the Patchstack advisory before treating it as fully unauthenticated.

An attacker injects a malicious script payload into an input processed by the WordPress File Upload plugin, which is stored persistently. When an administrator or other user later views the page rendering that stored content, the script executes in their authenticated browser session, potentially enabling session/cookie theft or actions in the site context. No public exploit code or proof-of-concept was identified in the provided data.