CVE-2026-125822

Published 15 November 2026 · tracked since 15 November 2026

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File Upload wp-file-upload allows Stored XSS.This issue affects WordPress File Upload: from n/a through 5.2.3.

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-129091 HIGH 8.1
• CVE-2026-125795 CRITICAL 9.8
• CVE-2026-125771 HIGH 7.2
• CVE-2026-129482 MEDIUM 4.8
• CVE-2026-125449 HIGH 8.8
• CVE-2026-122662 CRITICAL 9.8
• CVE-2026-82663 HIGH 7.5
• CVE-2026-82568 HIGH 7.5
• CVE-2026-129349
• CVE-2026-129444 CRITICAL 10

→ Open the live CVE board · all tools