CVE-2026-66570

LOWCVSS 7.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File Upload wp-file-upload allows Stored XSS.This issue affects WordPress File Upload: from n/a through 5.2.1.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://patchstack.com/database/wordpress/plugin/wp-file-upload/vulnerability/wordpress-wordpress-file-upload-plugin-5-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Referenced assets1 URL

By indicator

https://cve.now/CVE-2026-66570?utm_source=x&utm_medium=social&utm_campaign=cvedotnow&utm_content=critical

Full discourse1 post

cve.now@cvedotnow1d
🆕 New CVE WordPress: stored xss in file upload component (CVE-2026-66570) An attacker can inject scripts that run in visitors' browsers, potentially hijacking sessions or acting as them. No patch listed yet https://cve.now/CVE-2026-66570?utm_source=x&utm_medium=social&utm_campaign=cvedotnow&utm_content=critical
0201452.3K
20.7K followersView on X

Explore more

Back to dashboard