{
 "id": "WPSEC-2026-3094",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3094/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3094/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3094/index.md",
 "title": "Iptanus File Upload <= 5.2.3 - Unauthenticated Stored Cross-Site Scripting via File Upload HTML Content Detection Bypass",
 "description": "The Iptanus File Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via uploaded files in all versions up to, and including, 5.2.3 due to an insufficient HTML-content upload check. A file that begins with a vertical-tab character or with an incomplete HTML tag name (for example <bx>) bypasses the check, yet browsers still sniff and render it as HTML. This makes it possible for unauthenticated attackers, when an upload form is available to visitors, to upload files containing arbitrary web scripts that execute whenever a user accesses the uploaded file.",
 "plugin": {
  "slug": "wp-file-upload",
  "name": "Iptanus File Upload",
  "full_name": "Iptanus File Upload",
  "wordpress_org": "https://wordpress.org/plugins/wp-file-upload/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-file-upload/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-file-upload"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.2,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.2.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.2.4"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.2.4",
 "remediation": "Update to 5.2.4 or later.",
 "fix_released": "2026-11-12T16:38:59+00:00",
 "published": "2026-11-13T16:44:01+00:00",
 "updated": "2026-11-13T15:54:09.319286+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3094/",
  "https://plugins.svn.wordpress.org/wp-file-upload/tags/5.2.4/",
  "https://wordpress.org/plugins/wp-file-upload/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-file-upload",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-13"
 }
}