Skip to content
PluginCanary

Iptanus File Upload

by nickboss · 10,000+ active installs · Checked 4 Nov 2026
Healthy

Healthy: maintained, last release 29 Oct 2026, 21 releases in 24 months, no unpatched vulnerabilities.

86/ 100 Canary Score
Sub-scores for Iptanus File Upload
Ownership100
Maintenance100
Security60
SupportNo data
ReputationNo data

How the score works

Quick answers

Is Iptanus File Upload still maintained?
Yes. Last release 29 Oct 2026, 21 releases in the last 24 months. 29 Oct 2026 · wordpress.org
Who owns Iptanus File Upload, and has it changed hands?
No change recorded. Main committer nickboss since Dec 2013. 4 Nov 2026 · SVN log
Was Iptanus File Upload removed from wordpress.org?
No. Listed on wordpress.org as of 4 Nov 2026. 4 Nov 2026 · wordpress.org
Is Iptanus File Upload safe?
35 known vulnerabilities, all fixed (latest in 5.2.2). Not on the exploited list. 30 Oct 2026 · Wordfence Intelligence
Is the latest Iptanus File Upload update safe to install?
No ownership change before 5.2.2. No one-star spike after it. 29 Oct 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
nickboss9 Dec 2013 to 29 Oct 2026, 339 commits

1 committer recorded. No ownership change since 2013.

Maintenance

Last release
6 days ago
Releases, 24 months
21
Tested up to
7.1 current
Requires PHP
not stated supported 8.2+
Releases per quarter
Releases per quarter for Iptanus File Upload
Q1 20243
Q2 20241
Q3 20244
Q4 20243
Q1 20256
Q2 20250
Q3 20250
Q4 20257
Q1 20261
Q2 20260
Q3 20263
Q4 20262

Last release 29 Oct 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: no reviews. Lifetime: 4.4.

Average rating per quarter for Iptanus File Upload
Q4 20235.0
Q1 20245.0
Q2 20245.0
Q1 20251.0
Q1 20265.0

Average rating stayed at 5.0 between Q4 2023 and Q1 2026.

Rating distribution
5 star97
4 star3
3 star2
2 star2
1 star13
Latest low reviews

Security record

10 vulnerabilities in 24 months (35 on record), all patched (latest fixed in 5.2.2).

Show 35 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
30 Oct 2026Iptanus File Upload <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting7.2<= 5.2.15.2.2Patched before disclosure
1 Oct 2026Iptanus File Upload <= 5.1.10 - Unauthenticated SQL Injection7.5<= 5.1.105.2.0Patched before disclosure
5 Aug 2026Iptanus File Upload <= 5.1.7 - Unauthenticated SQL Injection7.5<= 5.1.75.1.8Patched before disclosure
3 Aug 2026File Upload <= 5.1.7 - Unauthenticated SQL Injection7.5<= 5.1.75.1.8Patched before disclosure
24 May 2026Iptanus File Upload <= 5.1.6 - Unauthenticated Race Condition to File Overwrite5.3<= 5.1.65.1.7Patched before disclosure
24 Feb 2025WordPress File Upload <= 4.25.2 - Cross-Site Request Forgery in wfu_file_details4.3<= 4.25.24.25.3Patched before disclosure
7 Jan 2025WordPress File Upload <= 4.24.12 - Unuathenticated Remote Code Execution9.8<= 4.24.124.24.14Patched before disclosure
7 Jan 2025WordPress File Upload <= 4.24.15 - Unauthenticated Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion9.8<= 4.24.154.25.0Patched before disclosure
7 Jan 2025WordPress File Upload <= 4.24.13 - Unauthenticated Path Traversal to Arbitrary File Read in wfu_file_downloader.php7.5<= 4.24.134.24.14Patched before disclosure
6 Jan 2025WordPress File Upload <= 4.24.15 - Missing Authorization to Authenticated (Subscriber+) Limited Path Traversal4.3<= 4.24.154.25.0Patched before disclosure
11 Oct 2024WordPress File Upload <= 4.24.11 - Unauthenticated Path Traversal to Arbitrary File Read and Deletion in wfu_file_downloader.php9.8<= 4.24.114.24.12Patched before disclosure
15 Aug 2024WordPress File Upload <= 4.24.8 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload7.2<= 4.24.84.24.9Patched before disclosure
1 Aug 2024WordPress File Upload <= 4.24.7 - Missing Authorization5.4<= 4.24.74.24.8Patched before disclosure
16 Jul 2024WordPress File Upload <= 4.24.7 - Reflected Cross-Site Scripting6.1<= 4.24.74.24.8Patched before disclosure
16 Jul 2024WordPress File Upload <= 4.24.7 - Unauthenticated Stored Cross-Site Scripting7.2<= 4.24.74.24.8Patched before disclosure
15 Jul 2024WordPress File Upload <= 4.24.7 - Authenticated (Contributor+) Directory Traversal4.3<= 4.24.74.24.81
29 Mar 2024WordPress File Upload <= 4.24.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4<= 4.24.54.24.6Patched before disclosure
14 Nov 2023Wordpress File Upload 4.24.0 - Cross-Site Request Forgery4.3<= 4.24.04.24.1Patched before disclosure
12 Sep 2023Wordpress File Upload <= 4.23.2 - Authenticated(Administrator+) Stored Cross-Site Scripting4.4< 4.23.34.23.31
23 May 2023WordPress File Upload / WordPress File Upload Pro <= 4.19.1 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4<= 4.19.14.19.2Patched before disclosure
23 May 2023WordPress File Upload / WordPress File Upload Pro <= 4.19.1 - Authenticated (Administrator+) Path Traversal4.9<= 4.19.14.19.2Patched before disclosure
15 May 2022WordPress File Upload <= 4.16.3 - Cross-Site Scripting5.4<= 4.16.34.16.41
1 Mar 2022WordPress File Upload / WordPress File Upload Pro <= 4.16.2 - Authenticated (Contributor+) Path Traversal6.5<= 4.16.24.16.3Patched before disclosure
14 Feb 2022WordPress File Upload <= 4.16.2 - Authenticated Stored Cross-Site Scripting via Shortcode5.4< 4.16.34.16.3Patched before disclosure
14 Feb 2022WordPress File Upload <= 4.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Malicious SVG5.4< 4.16.34.16.3Patched before disclosure

Changelog mentions of security fixes: 5.2.0 (security, SQL injection, sanitize); 5.2.1 (security); 5.2.2 (security).

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

100% of 1 support threads resolved in the last 2 months.

Momentum

10,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Iptanus File Upload
4 May 2026330
11 May 2026476
18 May 2026433
25 May 2026640
1 Jun 2026419
8 Jun 2026473
15 Jun 2026419
22 Jun 2026377
29 Jun 2026423
6 Jul 2026425
13 Jul 2026548
20 Jul 2026463
27 Jul 20264,648
3 Aug 20268,797
10 Aug 20261,244
17 Aug 20261,359
24 Aug 2026844
31 Aug 2026890
7 Sep 2026728
14 Sep 2026714
21 Sep 20265,848
28 Sep 20262,516
5 Oct 20262,096
12 Oct 20266,677
19 Oct 20262,400
26 Oct 20267,924
2 Nov 2026435

Weekly downloads over the last 4 weeks are 124% above the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

Online FormsScore 100 · 20,000+Zoho FormsScore 100 · 10,000+RTMFormScore 98 · 30,000+WPZOOM FormsScore 98 · 10,000+FormLayerScore 96 · 100,000+

Facts

Version5.2.2
Authornickboss
Added9 Dec 2013
Last updated29 Oct 2026
Active installs10,000+
Requires WordPress3.0
Tested up to7.1.4
Requires PHPnot stated
Categorynot stated
Tagswebcam, file upload, upload form, user uploads, Front end upload

Questions

Is Iptanus File Upload still maintained?

Yes. Last release 29 Oct 2026, 21 releases in the last 24 months.

Who owns Iptanus File Upload, and has it changed hands?

No change recorded. Main committer nickboss since Dec 2013.

Was Iptanus File Upload removed from wordpress.org?

No. Listed on wordpress.org as of 4 Nov 2026.

Is Iptanus File Upload safe?

35 known vulnerabilities, all fixed (latest in 5.2.2). Not on the exploited list.

Is the latest Iptanus File Upload update safe to install?

No ownership change before 5.2.2. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 4 Nov 2026.Report a data issue