# Iptanus File Upload

> Front-end file upload forms for WordPress. Build them visually, add your own fields, and capture photos from a webcam.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 10:32 UTC.

## Facts (WordPress.org)

- Slug: `wp-file-upload`
- Author: nickboss
- Version: 5.2.4
- Active installs: 10,000+
- Last update: 2026-11-12 (1 day ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 3.0, PHP any
- Tags: file upload, Front end upload, upload form, user uploads, webcam
- Page: https://wordpress.org/plugins/wp-file-upload/

## Checks (against WordPress 7.1.4)

- OK: Updated 1 day ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Leaky ↔ Spam-proof, Slows pages ↔ Speeds up, Inaccessible ↔ Accessible, Paywalled ↔ Generous, Locked in ↔ Portable, Behind ↔ Current.

## Known vulnerabilities

- 2026-11-09 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 5.2.2). CVE-2026-123460, https://www.wordfence.com/threat-intel/vulnerabilities/id/4db88c63-4665-436e-84bd-f77bad651b66?source=api-prod
- 2026-11-01 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 5.2.1). CVE-2026-66570, https://www.wordfence.com/threat-intel/vulnerabilities/id/23146e22-0935-4907-8849-600bc390e83c?source=api-prod
- 2026-10-01 HIGH: Unauthenticated SQL Injection (up to 5.1.10). CVE-2026-62071, https://www.wordfence.com/threat-intel/vulnerabilities/id/7e869568-9de9-40b9-b826-aa35585e19cb?source=api-prod
- 2026-08-09 HIGH: Unauthenticated SQL Injection (up to 5.1.7). CVE-2026-17044, https://www.wordfence.com/threat-intel/vulnerabilities/id/f07878bd-4d52-4eb8-9d9f-ed2e31e07c4e?source=api-prod
- 2026-08-06 HIGH: Unauthenticated SQL Injection (up to 5.1.7). CVE-2026-66447, https://www.wordfence.com/threat-intel/vulnerabilities/id/0368ec17-107c-476c-9627-b6a7ebc3c365?source=api-prod
- 2026-06-14 MEDIUM: Unauthenticated Race Condition to File Overwrite (up to 5.1.6). CVE-2025-15546, https://www.wordfence.com/threat-intel/vulnerabilities/id/029f6286-5a97-4fe0-8c02-97d8cb2ed396?source=api-prod
- 2025-02-24 MEDIUM: Cross-Site Request Forgery in wfu_file_details (up to 4.25.2). CVE-2024-13494, https://www.wordfence.com/threat-intel/vulnerabilities/id/595a6ab3-0731-4ef4-a385-5dfebbd917f4?source=api-prod
- 2025-01-07 CRITICAL: Unauthenticated Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion (up to 4.24.15). CVE-2024-11613, https://www.wordfence.com/threat-intel/vulnerabilities/id/31052fe6-a0ae-4502-b2d2-dbc3b3bf672f?source=api-prod
- 2025-01-07 HIGH: Unauthenticated Path Traversal to Arbitrary File Read in wfu_file_downloader.php (up to 4.24.13). CVE-2024-9939, https://www.wordfence.com/threat-intel/vulnerabilities/id/5e51f301-026d-4ed7-82f8-96c1623bf95c?source=api-prod
- 2025-01-07 CRITICAL: Unuathenticated Remote Code Execution (up to 4.24.12). CVE-2024-11635, https://www.wordfence.com/threat-intel/vulnerabilities/id/b5165f60-6515-4a2c-a124-cc88155eaf01?source=api-prod
- 2025-01-06 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Limited Path Traversal (up to 4.24.15). CVE-2024-12719, https://www.wordfence.com/threat-intel/vulnerabilities/id/314ae0f5-8a4e-4bf3-9fc9-49f5b036b99e?source=api-prod
- 2024-10-11 CRITICAL: Unauthenticated Path Traversal to Arbitrary File Read and Deletion in wfu_file_downloader.php (up to 4.24.11). CVE-2024-9047, https://www.wordfence.com/threat-intel/vulnerabilities/id/554a314c-9e8e-4691-9792-d086790ef40f?source=api-prod
- 2024-08-15 HIGH: Unauthenticated Stored Cross-Site Scripting via SVG File Upload (up to 4.24.8). CVE-2024-7301, https://www.wordfence.com/threat-intel/vulnerabilities/id/e2b16b9c-48c7-4370-839b-696797ff2101?source=api-prod
- 2024-08-01 MEDIUM: Missing Authorization (up to 4.24.7). CVE-2024-39639, https://www.wordfence.com/threat-intel/vulnerabilities/id/8fd93c96-36e9-4e9b-a7ef-b4dc6b7221a8?source=api-prod
- 2024-07-16 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 4.24.7). CVE-2024-6494, https://www.wordfence.com/threat-intel/vulnerabilities/id/332909d5-e3bf-42a7-af52-c4e50b05f97e?source=api-prod
- 2024-07-16 MEDIUM: Reflected Cross-Site Scripting (up to 4.24.7). CVE-2024-6651, https://www.wordfence.com/threat-intel/vulnerabilities/id/9dc49d44-d4ba-49d8-96eb-547832fe4b5e?source=api-prod
- 2024-07-15 MEDIUM: Authenticated (Contributor+) Directory Traversal (up to 4.24.7). CVE-2024-5852, https://www.wordfence.com/threat-intel/vulnerabilities/id/39bb69e0-fb18-4737-9eb7-bda2b5bc16a2?source=api-prod
- 2024-03-29 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (up to 4.24.5). CVE-2024-2847, https://www.wordfence.com/threat-intel/vulnerabilities/id/9f665099-d1c3-43a9-b37b-c9f42c9172ad?source=api-prod
- 2023-11-14 MEDIUM: Cross-Site Request Forgery (up to 4.24.0). WF-b6048088-c11c-4741-8dde-da707f8f84f2, https://www.wordfence.com/threat-intel/vulnerabilities/id/b6048088-c11c-4741-8dde-da707f8f84f2?source=api-prod
- 2023-09-12 MEDIUM: Authenticated(Administrator+) Stored Cross-Site Scripting (before 4.23.3). CVE-2023-4811, https://www.wordfence.com/threat-intel/vulnerabilities/id/0e1915d9-8ea9-4ab2-9746-3c49bc0bd7c8?source=api-prod
- 2023-05-23 MEDIUM: Authenticated (Administrator+) Stored Cross-Site Scripting (up to 4.19.1). WF-23334d94-e5b8-4c88-8765-02ad19e17248, https://www.wordfence.com/threat-intel/vulnerabilities/id/23334d94-e5b8-4c88-8765-02ad19e17248?source=api-prod
- 2023-05-23 MEDIUM: Authenticated (Administrator+) Path Traversal (up to 4.19.1). WF-abd6eeac-0a7e-4762-809f-593cd85f303d, https://www.wordfence.com/threat-intel/vulnerabilities/id/abd6eeac-0a7e-4762-809f-593cd85f303d?source=api-prod
- 2022-05-15 MEDIUM: Cross-Site Scripting (up to 4.16.3). WF-7534f2e5-a296-4c54-99e3-d84f5c9a5b51, https://www.wordfence.com/threat-intel/vulnerabilities/id/7534f2e5-a296-4c54-99e3-d84f5c9a5b51?source=api-prod
- 2022-03-01 MEDIUM: Authenticated (Contributor+) Path Traversal (up to 4.16.2). WF-b9cc0348-396e-4be1-92f5-851d20804ef5, https://www.wordfence.com/threat-intel/vulnerabilities/id/b9cc0348-396e-4be1-92f5-851d20804ef5?source=api-prod
- 2022-02-14 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Malicious SVG (before 4.16.3). CVE-2021-24960, https://www.wordfence.com/threat-intel/vulnerabilities/id/19e9a9f7-d2e3-4ebb-b121-99c7c81ede4f?source=api-prod
- 2022-02-14 MEDIUM: Authenticated Stored Cross-Site Scripting via Shortcode (before 4.16.3). CVE-2021-24961, https://www.wordfence.com/threat-intel/vulnerabilities/id/499483a0-957b-459e-b2f5-fc39c4f86c9e?source=api-prod
- 2020-03-13 CRITICAL: Directory Traversal to Remote Code Execution (up to 4.12.2). CVE-2020-10564, https://www.wordfence.com/threat-intel/vulnerabilities/id/fb5a65a2-e748-4c23-8cae-cb0a7de74911?source=api-prod
- 2018-04-06 MEDIUM: Stored Cross-Site Scripting (before 4.3.4). CVE-2018-9844, https://www.wordfence.com/threat-intel/vulnerabilities/id/fd60fa87-d3da-4e3f-bd9b-b9d117bdbc4c?source=api-prod
- 2018-03-31 MEDIUM: Cross-Site Scripting via Shortcodes (before 4.3.3). CVE-2018-9172, https://www.wordfence.com/threat-intel/vulnerabilities/id/7d65a987-e8a6-4615-b681-9f48b7caed4f?source=api-prod
- 2016-06-23 CRITICAL: Arbitrary File Upload (before 3.9.0). WF-8ada8a27-752c-4726-b330-895b967ea290, https://www.wordfence.com/threat-intel/vulnerabilities/id/8ada8a27-752c-4726-b330-895b967ea290?source=api-prod
- 2015-10-29 CRITICAL: Arbitrary File Upload (before 3.4.1). CVE-2015-9341, https://www.wordfence.com/threat-intel/vulnerabilities/id/fd8e6b8a-0161-4bf7-b480-77258337e9b9?source=api-prod
- 2015-07-02 CRITICAL: Arbitrary File Upload (before 3.0.0). CVE-2015-9340, https://www.wordfence.com/threat-intel/vulnerabilities/id/ffeb4b5e-4c83-4b0e-a513-6b5cada95073?source=api-prod
- 2015-05-09 HIGH: Arbitrary File Upload (before 2.7.1). CVE-2015-9339, https://www.wordfence.com/threat-intel/vulnerabilities/id/65a02152-be62-4e27-8a31-e88f23e0236f?source=api-prod
- 2015-01-23 CRITICAL: Arbitrary File Upload (up to 2.4.6). CVE-2015-9338, https://www.wordfence.com/threat-intel/vulnerabilities/id/85bea3da-f54a-4a77-9abe-6c24bbdcc25c?source=api-prod
- 2014-08-20 MEDIUM: Reflected Cross-Site Scripting (up to 2.4.3). CVE-2014-125110, https://www.wordfence.com/threat-intel/vulnerabilities/id/a85eec18-49cc-44c0-ac86-ccc192a621a0?source=api-prod
- 2014-08-08 MEDIUM: Cross-Site Request Forgery (before 2.4.2). CVE-2014-5199, https://www.wordfence.com/threat-intel/vulnerabilities/id/b3083afd-ca84-4088-8e72-95254d56a0c0?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=wp-file-upload · HTML: https://todaywp.com/plugins/wp-file-upload