{
 "id": "WPSEC-2026-2144",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2144/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2144/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2144/index.md",
 "title": "Iptanus File Upload <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting via HTML Polyglot File Upload",
 "description": "The Iptanus File Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via polyglot file uploads in all versions up to, and including, 5.2.1. This is due to insufficient file content validation: uploaded files are scanned for script tags only when their detected MIME type is text, so a file whose MIME type is detected as non-text (for example a 3GP video file) but whose leading bytes are HTML containing a script is accepted. This makes it possible for unauthenticated attackers, where an upload form is available to them, to upload files that browsers may interpret as HTML, injecting arbitrary web scripts that execute whenever a user accesses the uploaded file.",
 "plugin": {
  "slug": "wp-file-upload",
  "name": "Iptanus File Upload",
  "full_name": "Iptanus File Upload",
  "wordpress_org": "https://wordpress.org/plugins/wp-file-upload/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-file-upload/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-file-upload"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.2,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.2.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.2.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.2.2",
 "remediation": "Update to 5.2.2 or later.",
 "fix_released": "2026-10-29T19:44:22+00:00",
 "published": "2026-10-30T20:44:05+00:00",
 "updated": "2026-10-30T09:24:23.663639+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2144/",
  "https://plugins.svn.wordpress.org/wp-file-upload/tags/5.2.2/",
  "https://wordpress.org/plugins/wp-file-upload/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-file-upload",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Low",
  "as_of": "2026-10-30"
 }
}