CVE-2026-66570

HighCVSS 7.1/10Last modified Nov 2, 2026

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File Upload wp-file-upload allows Stored XSS.This issue affects WordPress File Upload: from n/a through 5.2.1.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
NickbossWordPress File Upload<= 5.2.1

References

Timeline

Published
Nov 1, 2026
Last modified
Nov 2, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-665717.1Unauthenticated Cross Site Request Forgery (CSRF) in Asset CleanUp: Page Speed Booster <= 1.4.0.5 versions.CVE-2026-665726.5Contributor Cross Site Scripting (XSS) in JetBlog <= 2.4.10 versions.CVE-2026-665736.5Contributor Cross Site Scripting (XSS) in JetTabs <= 2.3.3.1 versions.CVE-2026-665746.5Contributor Cross Site Scripting (XSS) in Element Pack Elementor Addons <= 8.8.3 versions.CVE-2026-665755.3Unauthenticated Insecure Direct Object References (IDOR) in King Addons for Elementor <= 51.1.81 versions.CVE-2026-665766.5Contributor Cross Site Scripting (XSS) in JetBlocks For Elementor <= 1.5.2 versions.CVE-2026-665776.5Contributor Cross Site Scripting (XSS) in JetSearch <= 3.6.3 versions.CVE-2026-665786.5Contributor Cross Site Scripting (XSS) in PropertyHive <= 2.2.6 versions.CVE-2026-665796.5Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.2.1 versions.CVE-2026-66585.4A vulnerability in jupyter/nbconvert versions <= 7.17.0 allows for Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HCVE-2026-665808.5Contributor SQL Injection in Product Feed Manager <= 7.12.0 versions.CVE-2026-665817.1Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.1 versions.
CVE-2026-66570: High severity, CVSS 7.1 | Vulnix