Is Iptanus File Upload safe?

Every recorded flaw

• Oct 1, 2026Unauthenticated SQL Injection in WordPress File Upload <= 5.1.10 versions.CVE-2026-62071 · affects up to 5.1.10 · reported by PatchstackCritical 9.3
• Aug 9, 2026Iptanus File Upload: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2026-17044 · fixed in 5.1.8 · reported by WPScanHigh 8.6
• Aug 6, 2026Unauthenticated SQL Injection in WordPress File Upload <= 5.1.7 versions.CVE-2026-66447 · affects up to 5.1.7 · reported by PatchstackCritical 9.3
• Jun 14, 2026Iptanus File Upload: Does not implement proper file handlingCVE-2025-15546 · fixed in 5.1.7 · reported by WPScanMedium 5.4
• Feb 25, 2025WordPress File Upload: Cross-Site Request ForgeryCVE-2024-13494 · affects up to 4.25.2 · reported by WordfenceMedium 4.3
• Jan 8, 2025WordPress File Upload: Path TraversalCVE-2024-9939 · affects up to 4.24.13 · reported by Wordfence1.0% oddsHigh 7.5
• Jan 8, 2025WordPress File Upload: Remote Code ExecutionCVE-2024-11635 · affects up to 4.24.12 · reported by Wordfence1.5% oddsCritical 9.8
• Jan 8, 2025WordPress File Upload: Remote Code Execution, Arbitrary File Read, and Arbitrary File DeletionCVE-2024-11613 · affects up to 4.24.15 · reported by Wordfence4.4% oddsCritical 9.8
• Jan 7, 2025WordPress File Upload: Unauthorized access of dataCVE-2024-12719 · affects up to 4.24.15 · reported by WordfenceMedium 4.3
• Nov 1, 2024WordPress File Upload: Broken Access ControlCVE-2024-39639 · affects up to 4.24.7 · reported by PatchstackMedium 4.3
• Oct 12, 2024WordPress File Upload: Path TraversalCVE-2024-9047 · affects up to 4.24.11 · reported by Wordfence93% oddsCritical 9.8
• Aug 16, 2024WordPress File Upload: Stored Cross-Site ScriptingCVE-2024-7301 · affects up to 4.24.8 · reported by WordfenceHigh 7.2
• Aug 7, 2024WordPress File Upload: Does not properly sanitize and escape certain parametersCVE-2024-6494 · fixed in 4.24.8 · reported by WPScanMedium 6.1
• Aug 6, 2024WordPress File Upload: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-6651 · fixed in 4.24.8 · reported by WPScan16% oddsMedium 6.1
• Jul 16, 2024WordPress File Upload: Directory TraversalCVE-2024-5852 · affects up to 4.24.7 · reported by WordfenceMedium 4.3
• Apr 9, 2024WordPress File Upload: Stored Cross-Site ScriptingCVE-2024-2847 · affects up to 4.24.5 · reported by WordfenceMedium 6.4
• Mar 31, 2024A vulnerability has been found in wp-file-upload Plugin up to 2.4.3 on WordPress and classified as problematic.CVE-2014-125110 · affects up to 2.4.3 · reported by VulDBLow 3.5
• Oct 16, 2023WordPress File Upload: Does not sanitise and escape some of its settingsCVE-2023-4811 · fixed in 4.23.3 · reported by WPScanMedium 5.4
• Jun 9, 2023The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are vulnerable to Stored Cross-Site Scripting via admin settings in versions up toCVE-2023-2767 · affects up to 4.19.1 · reported by WordfenceMedium 4.4
• Jun 9, 2023The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are vulnerable to Path Traversal in versions up to, and including, 4.19.1 via the CVE-2023-2688 · affects up to 4.19.1 · reported by Wordfence1.7% oddsMedium 4.9
• Mar 13, 2020An issue was discovered in the File Upload plugin before 4.13.0 for WordPress.CVE-2020-10564 · fixed in 4.13.0 · reported by MITRE8.6% oddsCritical 9.8
• Aug 22, 2019The wp-file-upload plugin before 3.0.0 for WordPress has insufficient restrictions on upload of php, js, pht, php3, php4, php5, phtml, htm, html, and htaccess fCVE-2015-9340 · fixed in 3.0.0 · reported by MITRE1.4% oddsHigh 7.5
• Aug 22, 2019The wp-file-upload plugin before 2.7.1 for WordPress has insufficient restrictions on upload of .js files.CVE-2015-9339 · fixed in 2.7.1 · reported by MITRE1.4% oddsHigh 7.5
• Aug 22, 2019The wp-file-upload plugin before 2.5.0 for WordPress has insufficient restrictions on upload of .php files.CVE-2015-9338 · fixed in 2.5.0 · reported by MITRE1.4% oddsHigh 7.5
• Aug 22, 2019The wp-file-upload plugin before 3.4.1 for WordPress has insufficient restrictions on upload of .php.js files.CVE-2015-9341 · fixed in 3.4.1 · reported by MITRE1.4% oddsHigh 7.5
• Apr 7, 2018The Iptanus WordPress File Upload plugin before 4.3.4 for WordPress mishandles Settings attributes, leading to XSS.CVE-2018-9844 · fixed in 4.3.4 · reported by MITRE3.6% oddsMedium 6.1
• Apr 1, 2018The Iptanus WordPress File Upload plugin before 4.3.3 for WordPress mishandles shortcode attributes.CVE-2018-9172 · fixed in 4.3.3 · reported by MITRE3.1% oddsMedium 5.4
• Aug 12, 2014Cross-site request forgery (CSRF) vulnerability in the WordPress File Upload plugin (wp-file-upload) before 2.4.2 for WordPress allows remote attackers to hijacCVE-2014-5199 · fixed in 2.4.2 · reported by MITREMedium 6.8

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.