VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Iptanus File Upload security & vulnerabilities

wp-file-upload— active installsLast vulnerability Nov 7, 2026

No known unpatched vulnerabilities in the latest version

All 36 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
36Known vulnerabilities
  • Critical8
  • High9
  • Medium19
  • Low0
Vulnerabilities per year
2014: 2 vulnerabilities2142015: 4 vulnerabilities4152016: 1 vulnerability1162018: 2 vulnerabilities2182020: 1 vulnerability1202022: 4 vulnerabilities4222023: 4 vulnerabilities4232024: 7 vulnerabilities7242025: 5 vulnerabilities5252026: 6 vulnerabilities626

All Iptanus File Upload vulnerabilities

Iptanus File Upload vulnerabilities
SeverityVulnerabilityCVEPublished
High7.2Unauthenticated Stored Cross-Site Scripting
≤5.2.2Update to 5.2.3
CVE-2026-123460
High7.2Unauthenticated Stored Cross-Site Scripting
≤5.2.1Update to 5.2.2
CVE-2026-66570
High7.5Unauthenticated SQL Injection
≤5.1.10Update to 5.2.0
CVE-2026-62071
High7.5Unauthenticated SQL Injection
≤5.1.7Update to 5.1.8
CVE-2026-66447
High7.5Unauthenticated SQL Injection
≤5.1.7Update to 5.1.8
CVE-2026-17044
Medium5.3Unauthenticated Race Condition to File Overwrite
≤5.1.6Update to 5.1.7
CVE-2025-15546
Medium4.3Cross-Site Request Forgery in wfu_file_details
≤4.25.2Update to 4.25.3
CVE-2024-13494
Critical9.8Unuathenticated Remote Code Execution
≤4.24.12Update to 4.24.14
CVE-2024-11635
Critical9.8Unauthenticated Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion
≤4.24.15Update to 4.25.0
CVE-2024-11613
High7.5Unauthenticated Path Traversal to Arbitrary File Read in wfu_file_downloader.php
≤4.24.13Update to 4.24.14
CVE-2024-9939
Medium4.3Missing Authorization to Authenticated (Subscriber+) Limited Path Traversal
≤4.24.15Update to 4.25.0
CVE-2024-12719
Critical9.8Unauthenticated Path Traversal to Arbitrary File Read and Deletion in wfu_file_downloader.php
≤4.24.11Update to 4.24.12
CVE-2024-9047
High7.2Unauthenticated Stored Cross-Site Scripting via SVG File Upload
≤4.24.8Update to 4.24.9
CVE-2024-7301
Medium5.4Missing Authorization
≤4.24.7Update to 4.24.8
CVE-2024-39639
Medium6.1Reflected Cross-Site Scripting
≤4.24.7Update to 4.24.8
CVE-2024-6651
High7.2Unauthenticated Stored Cross-Site Scripting
≤4.24.7Update to 4.24.8
CVE-2024-6494
Medium4.3Authenticated (Contributor+) Directory Traversal
≤4.24.7Update to 4.24.8
CVE-2024-5852
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤4.24.5Update to 4.24.6
CVE-2024-2847
Medium4.3Cross-Site Request Forgery
≤4.24.0Update to 4.24.1
—
Medium4.4Authenticated(Administrator+) Stored Cross-Site Scripting
<4.23.3Update to 4.23.3
CVE-2023-4811
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤4.19.1Update to 4.19.2
CVE-2023-2767
Medium4.9Authenticated (Administrator+) Path Traversal
≤4.19.1Update to 4.19.2
CVE-2023-2688
Medium5.4Cross-Site Scripting
≤4.16.3Update to 4.16.4
—
Medium6.5Authenticated (Contributor+) Path Traversal
≤4.16.2Update to 4.16.3
CVE-2021-24962
Medium5.4Authenticated Stored Cross-Site Scripting via Shortcode
<4.16.3Update to 4.16.3
CVE-2021-24961
Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via Malicious SVG
<4.16.3Update to 4.16.3
CVE-2021-24960
Critical9.8Directory Traversal to Remote Code Execution
≤4.12.2Update to 4.13.0
CVE-2020-10564
Medium6.1Stored Cross-Site Scripting
<4.3.4Update to 4.3.4
CVE-2018-9844
Medium4.1Cross-Site Scripting via Shortcodes
<4.3.3Update to 4.3.3
CVE-2018-9172
Critical9.8Arbitrary File Upload
<3.9.0Update to 3.9.0
—
Critical9.8Arbitrary File Upload
<3.4.1Update to 3.4.1
CVE-2015-9341
Critical9.8Arbitrary File Upload
<3.0.0Update to 3.0.0
CVE-2015-9340
High8.2Arbitrary File Upload
<2.7.1Update to 2.7.1
CVE-2015-9339
Critical9.8Arbitrary File Upload
≤2.4.6Update to 2.5.0
CVE-2015-9338
Medium6.1Reflected Cross-Site Scripting
≤2.4.3Update to 2.4.4
CVE-2014-125110
Medium6.3Cross-Site Request Forgery
<2.4.2Update to 2.4.2
CVE-2014-5199

Iptanus File Upload: common questions

Does Iptanus File Upload have known vulnerabilities?

Yes. VulnCrest Radar lists 36 known vulnerabilities in Iptanus File Upload: 8 critical, 9 high, 19 medium. None are known to affect version null.

How do I check which version of Iptanus File Upload I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Iptanus File Upload vulnerability?

CVE-2026-123460, published Nov 7, 2026: Iptanus File Upload <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting. Severity: High (CVSS 7.2).

Is any Iptanus File Upload vulnerability listed in CISA KEV?

No. None of the known Iptanus File Upload vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?