CVE-2026-123460 in File Upload Plugin
Summary
by MITRE • 11/09/2026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File Upload wp-file-upload allows Stored XSS.This issue affects WordPress File Upload: from n/a through 5.2.2.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/09/2026
The identified security flaw represents a classic instance of Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting or XSS. Specifically, this vulnerability is classified under the CWE-79 standard and manifests within the Nickboss WordPress File Upload plugin, affecting versions ranging from no specific lower bound through version 5.2.2. The core technical deficiency lies in the application's failure to adequately sanitize user-supplied input before it is rendered back into the web page context. In a typical file upload scenario, users provide metadata such as filenames or descriptions alongside their binary data. When this plugin processes these inputs and subsequently displays them on public-facing pages without proper encoding or escaping, malicious scripts embedded within that metadata are executed by the victim's browser in the context of the vulnerable website.
This specific implementation constitutes a Stored XSS vulnerability because the injected script is not merely transient but persists within the application's data store, such as a database. Unlike reflected XSS where the payload must be delivered via a crafted link to trigger execution, stored XSS ensures that every user who views the affected page containing the malicious content will have their browser execute the attacker-controlled code. This persistence significantly amplifies the severity of the vulnerability because it does not require social engineering tactics like phishing links to achieve widespread impact; rather, any visitor accessing the compromised file listing or metadata view becomes a potential victim automatically upon loading the page.
From an operational perspective, the exploitation of this flaw allows attackers to bypass same-origin policy restrictions and perform actions on behalf of authenticated users if they are logged in at the time of execution. The most common attack vector involves stealing session cookies, which can lead to complete account takeover for administrators or other privileged users. Furthermore, attackers may redirect victims to malicious sites designed to harvest credentials through phishing pages that mimic legitimate login portals. Beyond credential theft, this vulnerability enables defacement of web content by injecting HTML elements into the page structure and facilitates keylogging activities where keystrokes are captured and transmitted back to a remote server controlled by the attacker.
The attack pattern aligns with several techniques documented in the MITRE ATT&CK framework for enterprise security. The initial injection phase corresponds to T1059, Command and Scripting Interpreter, specifically using web browsers as the execution environment. If the attacker leverages this access to steal cookies or tokens, it maps directly to T1539, Steal Web Session Cookie. In scenarios where the XSS payload is used to load additional malicious scripts from external domains without user interaction, it also relates to T1071, Application Layer Protocol, specifically web protocols like HTTP/HTTPS for command and control communications.
To mitigate this vulnerability effectively, immediate action must be taken by updating the WordPress File Upload plugin to a version later than 5.2.2 where the input sanitization logic has been corrected. Developers should implement strict output encoding using context-aware methods such as HTML entity encoding when rendering user-supplied data in HTML contexts. Additionally, implementing Content Security Policy headers can provide an additional layer of defense by restricting the sources from which scripts are allowed to load and execute, thereby neutralizing many XSS payloads even if they manage to bypass input validation filters. Regular security audits and static code analysis tools should be employed during development cycles to detect similar patterns of improper input handling before deployment into production environments.