The vulnerability originates from insufficient sanitization of data supplied by users in the Nickboss WordPress File Upload plugin. The plugin stores arbitrary file metadata and does not neutralize potentially executable content before rendering it in the WordPress administration interface. Because the data is later included directly in HTML, an attacker can inject JavaScript that is executed whenever the page is viewed. The result is a Stored Cross‑Site Scripting condition enabling the attacker to run arbitrary scripts in the context of the website’s visitors.

The flaw exists in all releases of the WordPress File Upload plugin up through version 5.2.2. Any installation using these versions is affected. The vulnerability was identified in the plugin version range from the earliest available release through 5.2.2, inclusive. Upgrading to any version 5.2.3 or later mitigates the issue.

The CVSS score of 7.1 points to a high severity assessment, and the absence of an EPSS value means no published data indicates the likelihood of exploitation, though the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector requires an attacker to be able to upload a file via the plugin interface. An attacker who succeeds can have the script execute in the browsers of anyone who visits the affected site, potentially leading to session hijacking, defacement, or the distribution of malware. The risk level is moderate‑high until the plugin is updated.