Nickboss vulnerabilities
We track 6 vulnerabilities in Nickboss products across 2 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on November 9, 2026.
Latest Nickboss vulnerabilities
- 7.1 High severity
WordPress File Upload: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File Upload wp-file-upload allows Stored XSS.This issue affects WordPress File Upload: from n/a through 5.2.2.
- 7.1 High severity
WordPress File Upload: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File Upload wp-file-upload allows Stored XSS.This issue affects WordPress File Upload: from n/a through 5.2.1.
- 7.5 High severity
Iptanus File Upload: Improper Limitation of a Pathname to a Restricted Directory
The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.13 via wfu_file_downloader.php. This makes it possible for unauthenticated attackers to read files outside of the originally intended dire
- 9.8 Critical severity
Iptanus File Upload: Improper Control of Generation of Code
The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.24.12 via the 'wfu_ABSPATH' cookie parameter. This makes it possible for unauthenticated attackers to execute code on the server.
- 9.8 Critical severity
Iptanus File Upload: Improper Control of Generation of Code
The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion in all versions up to, and including, 4.24.15 via the 'wfu_file_downloader.php' file. This is due to lack of proper sanitiza
- 9.8 Critical severity
Iptanus File Upload: Improper Limitation of a Pathname to a Restricted Directory
The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.11 via wfu_file_downloader.php. This makes it possible for unauthenticated attackers to read or delete files outside of the originally int