{
 "id": "WPSEC-2026-2681",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2681/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2681/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2681/index.md",
 "title": "Iptanus File Upload <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting via HTML-Content File Upload Protection Bypass",
 "description": "The Iptanus File Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via uploaded files in all versions up to, and including, 5.2.2 due to an incomplete HTML-content detection check that can be bypassed when the opening HTML tag ends with a character other than a space, such as a slash. This makes it possible for unauthenticated attackers, where an upload form is available to them, to upload files containing HTML and JavaScript that pass the protection. The injected scripts execute whenever a user opens the uploaded file.",
 "plugin": {
  "slug": "wp-file-upload",
  "name": "Iptanus File Upload",
  "full_name": "Iptanus File Upload",
  "wordpress_org": "https://wordpress.org/plugins/wp-file-upload/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-file-upload/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-file-upload"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.2,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.2.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.2.3"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.2.3",
 "remediation": "Update to 5.2.3 or later.",
 "fix_released": "2026-11-05T19:40:27+00:00",
 "published": "2026-11-06T19:43:42+00:00",
 "updated": "2026-11-06T12:02:20.442154+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2681/",
  "https://plugins.svn.wordpress.org/wp-file-upload/tags/5.2.3/",
  "https://wordpress.org/plugins/wp-file-upload/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-file-upload",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-06"
 }
}