The WordPress File Upload plugin (nickboss Iptanus File Upload) suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated users with contributor-level permissions or above can inject arbitrary JavaScript via plugin shortcodes because the plugin fails to properly sanitize and escape user-supplied attributes. This malicious script is stored and executed in the context of any user viewing the affected page. The vulnerability affects all versions up to and including 4.24.5. The CVSS 3.1 score is 6.4 (medium severity), with attack vector network, low attack complexity, privileges required at the contributor level, no user interaction needed, scope changed, and impacts on confidentiality and integrity but not availability. No patch or official fix has been documented in the provided data.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages via plugin shortcodes. These scripts execute in the browsers of users who visit the infected pages, potentially leading to unauthorized actions such as session hijacking or data theft limited to the confidentiality and integrity impact as per CVSS. The vulnerability does not affect availability. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the vulnerable plugin to prevent exploitation. Monitor for updates from the vendor or WordPress plugin repository for a security patch.