Known vulnerabilities in Iptanus File Upload

THIS IS FORMER WORDPRESS FILE UPLOAD PLUGIN. Simple yet powerful plugin to allow users to upload files from any page, post or sidebar and manage them.

20Reported vulnerabilities

9.8Highest CVSS score

5.1.10Latest version

10,000+Active installs

What to do now

Update Iptanus File Upload to 5.1.8 or later. 20 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 3, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2024-9047	Critical 9.8	93.3%	Before 4.24.12	`4.24.12`	October 12, 2024
CVE-2020-10564	Critical 9.8	8.6%	Before 4.13.0	`4.13.0`	March 13, 2020
CVE-2018-9844	Medium 6.1	3.7%	Before 4.3.4	`4.3.4`	April 7, 2018
CVE-2018-9172	Medium 5.4	3.1%	Before 4.3.3	`4.3.3`	April 1, 2018
WF-8ada8a27-752c-4726-b330-895b967ea290	Critical 9.8	—	Before 3.9.0	`3.9.0`	June 23, 2016
CVE-2026-66447	Critical 9.3	0.2%	5.1.7 and earlier	`5.1.8`	August 6, 2026
CVE-2024-9939	High 7.5	1.1%	Before 4.24.14	`4.24.14`	January 8, 2025
CVE-2015-9340	High 7.5	1.4%	Before 3.0.0	`3.0.0`	August 22, 2019
CVE-2015-9339	High 7.5	1.4%	Before 2.7.1	`2.7.1`	August 22, 2019
CVE-2015-9338	High 7.5	1.4%	Before 2.5.0	`2.5.0`	August 22, 2019
CVE-2015-9341	High 7.5	1.4%	Before 3.4.1	`3.4.1`	August 22, 2019
CVE-2026-17044	High 7.5	0.3%	5.1.7 and earlier	`5.1.8`	August 3, 2026
CVE-2014-5199	Medium 6.8	1.0%	2.4.1 and earlier	`2.4.2`	August 12, 2014
CVE-2024-7301	Medium 6.1	0.5%	Before 4.24.9	`4.24.9`	August 16, 2024
CVE-2014-125110	Medium 6.1	0.5%	2.4.3 and earlier	`2.4.4`	August 20, 2014
WF-7534f2e5-a296-4c54-99e3-d84f5c9a5b51	Medium 5.4	—	4.16.3 and earlier	`4.16.4`	May 15, 2022
CVE-2024-13494	Medium 4.3	0.2%	Before 4.25.3	`4.25.3`	February 25, 2025
CVE-2024-12719	Medium 4.3	0.4%	Before 4.25.0	`4.25.0`	January 7, 2025
WF-b6048088-c11c-4741-8dde-da707f8f84f2	Medium 4.3	—	4.24.0 and earlier	`4.24.1`	November 14, 2023
CVE-2024-39639	Low 3.5	0.3%	Before 4.24.8	`4.24.8`	November 1, 2024

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.