Software intelligence
Important: Wp File Upload appearing in this catalog does not mean your website is affected. Exposure depends on your installed version. How SiteRespond intelligence works
Tracked advisories
32
Latest advisory
5 August 2026
CISA KEV matches
0
In this WordPress feed
WordPress slug
wp-file-upload
Plugin
This catalog lists 32 known advisories affecting Wp File Upload. The most recent was published on 5 August 2026. If you use this software, compare your installed version against the affected ranges on each advisory and update to a fixed release outside those ranges. SiteRespond Defence checks your actual installed version when the plugin is connected — listing here does not by itself mean your site is vulnerable.
Iptanus File Upload <= 5.1.7 - Unauthenticated SQL Injection
May allow attackers to read or modify database contents beyond intended access.
Published 5 August 2026
File Upload <= 5.1.7 - Unauthenticated SQL Injection
May allow attackers to read or modify database contents beyond intended access.
Published 3 August 2026
WordPress File Upload <= 4.25.2 - Cross-Site Request Forgery in wfu_file_details
May allow attackers to run arbitrary code on the server if exploited.
Published 24 February 2025
Known Wp File Upload advisories published by month.
CVE-2023-4811 · Published 12 September 2023
Affected versions: < 4.23.3
CVE-2023-2688 · Published 23 May 2023
Affected versions: ≤ 4.19.1
CVE-2023-2767 · Published 23 May 2023
Affected versions: ≤ 4.19.1
No CVE assigned · Published 15 May 2022
Affected versions: ≤ 4.16.3
CVE-2021-24962 · Published 1 March 2022
Affected versions: ≤ 4.16.2
CVE-2021-24961 · Published 14 February 2022
Affected versions: < 4.16.3
CVE-2021-24960 · Published 14 February 2022
Affected versions: < 4.16.3
CVE-2020-10564 · Published 13 March 2020
Affected versions: ≤ 4.12.2
CVE-2018-9844 · Published 6 April 2018
Affected versions: < 4.3.4
CVE-2018-9172 · Published 31 March 2018
Affected versions: < 4.3.3
No CVE assigned · Published 23 June 2016
Affected versions: < 3.9.0
CVE-2015-9341 · Published 29 October 2015
Affected versions: < 3.4.1
CVE-2015-9340 · Published 2 July 2015
Affected versions: < 3.0.0
CVE-2015-9339 · Published 9 May 2015
Affected versions: < 2.7.1
CVE-2015-9338 · Published 23 January 2015
Affected versions: ≤ 2.4.6
SiteRespond Defence matches your installed Wp File Upload version against this catalog when the Defence plugin is connected to your WordPress site.