WordPress plugin
Iptanus File Upload security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 36 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical8
- High9
- Medium19
- Low0
All Iptanus File Upload vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤5.2.2Update to 5.2.3 | CVE-2026-123460 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤5.2.1Update to 5.2.2 | CVE-2026-66570 | |
| High7.5 | Unauthenticated SQL Injection ≤5.1.10Update to 5.2.0 | CVE-2026-62071 | |
| High7.5 | Unauthenticated SQL Injection ≤5.1.7Update to 5.1.8 | CVE-2026-66447 | |
| High7.5 | Unauthenticated SQL Injection ≤5.1.7Update to 5.1.8 | CVE-2026-17044 | |
| Critical9.8 | Unuathenticated Remote Code Execution ≤4.24.12Update to 4.24.14 | CVE-2024-11635 | |
| Critical9.8 | Unauthenticated Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion ≤4.24.15Update to 4.25.0 | CVE-2024-11613 | |
| High7.5 | Unauthenticated Path Traversal to Arbitrary File Read in wfu_file_downloader.php ≤4.24.13Update to 4.24.14 | CVE-2024-9939 | |
| Critical9.8 | Unauthenticated Path Traversal to Arbitrary File Read and Deletion in wfu_file_downloader.php ≤4.24.11Update to 4.24.12 | CVE-2024-9047 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting via SVG File Upload ≤4.24.8Update to 4.24.9 | CVE-2024-7301 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤4.24.7Update to 4.24.8 | CVE-2024-6494 | |
| Critical9.8 | Directory Traversal to Remote Code Execution ≤4.12.2Update to 4.13.0 | CVE-2020-10564 | |
| Critical9.8 | Arbitrary File Upload <3.9.0Update to 3.9.0 | — | |
| Critical9.8 | Arbitrary File Upload <3.4.1Update to 3.4.1 | CVE-2015-9341 | |
| Critical9.8 | Arbitrary File Upload <3.0.0Update to 3.0.0 | CVE-2015-9340 | |
| High8.2 | Arbitrary File Upload <2.7.1Update to 2.7.1 | CVE-2015-9339 | |
| Critical9.8 | Arbitrary File Upload ≤2.4.6Update to 2.5.0 | CVE-2015-9338 |
- High7.2Unauthenticated Stored Cross-Site Scripting
≤5.2.2Update to 5.2.3
- High7.2Unauthenticated Stored Cross-Site Scripting
≤5.2.1Update to 5.2.2
- High7.5Unauthenticated SQL Injection
≤5.1.10Update to 5.2.0
- High7.5Unauthenticated SQL Injection
≤5.1.7Update to 5.1.8
- High7.5Unauthenticated SQL Injection
≤5.1.7Update to 5.1.8
- Critical9.8Unuathenticated Remote Code Execution
≤4.24.12Update to 4.24.14
- Critical9.8Unauthenticated Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion
≤4.24.15Update to 4.25.0
- High7.5Unauthenticated Path Traversal to Arbitrary File Read in wfu_file_downloader.php
≤4.24.13Update to 4.24.14
- Critical9.8Unauthenticated Path Traversal to Arbitrary File Read and Deletion in wfu_file_downloader.php
≤4.24.11Update to 4.24.12
- High7.2Unauthenticated Stored Cross-Site Scripting via SVG File Upload
≤4.24.8Update to 4.24.9
- High7.2Unauthenticated Stored Cross-Site Scripting
≤4.24.7Update to 4.24.8
- Critical9.8Directory Traversal to Remote Code Execution
≤4.12.2Update to 4.13.0
- Critical9.8Arbitrary File Upload
<3.9.0Update to 3.9.0
- Critical9.8Arbitrary File Upload
<3.4.1Update to 3.4.1
- Critical9.8Arbitrary File Upload
<3.0.0Update to 3.0.0
- High8.2Arbitrary File Upload
<2.7.1Update to 2.7.1
- Critical9.8Arbitrary File Upload
≤2.4.6Update to 2.5.0
Iptanus File Upload: common questions
Does Iptanus File Upload have known vulnerabilities?
Yes. VulnCrest Radar lists 36 known vulnerabilities in Iptanus File Upload: 8 critical, 9 high, 19 medium. None are known to affect version null.
How do I check which version of Iptanus File Upload I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Iptanus File Upload vulnerability?
CVE-2026-123460, published Nov 7, 2026: Iptanus File Upload <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting. Severity: High (CVSS 7.2).
Is any Iptanus File Upload vulnerability listed in CISA KEV?
No. None of the known Iptanus File Upload vulnerabilities is currently listed in the CISA KEV catalog.