Iptanus File Upload

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

227 searches this plugin appeared in over the last 90 days, 20 listed. 198 left out as unrelated or noise (years, numbers, stray words).

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 12 months ago; the previous band took 3.5 years to cross, which places it about 71% of the way through.

1. ★★★★★ Moveksdizajn

   9mo ago

   so simple and works good

   Read on wp.org ↗
2. ★★★★★ laurendev

   1.8y ago

   I was looking for a simple plugin for users to upload a singular jpeg or PDF to my website. This plugin rejects every file that is uploaded. I tried uploading several different types (jpeg, PDF and .doc) and it rejected all of them, saying each one was suspicious. The way around this according to the plugin page is to set up the Quarantine feature. But of course the quarantine feature is only possible by upgrading to the Premium version, rendering this app completely useless unless you pay to upgrade.

   Read on wp.org ↗
3. ★★★★★ revayatejahad

   2.5y ago

   Thank you very much for your great work! well done! I have some issue with the plugin and It would be great if you help me with them as soon as possible. first of all, I use the plugin inside Gravity form and I want the uploaded link could be saved with the form entry! I’ve tried different ways but didn’t come with the result! finally I just added the %pathfile% in the comment below when file successfully uploaded as a way to see the uploaded link but I want this path be saved some where with the form. but the link will disappears when we move to next page or next file upload! secondly, in wordpress dashboard > uploaded files, it doesn’t show the file path with the domain name of ftp server but it shows the direct ftp address to the file which is not wanted! thirdly, It would be great if the plugin asks the domain name and replace it with the ftp file address at the beginning of each file link. lastly, it would be fantastic if the (uploaded files)’s links and names could be exported in an xlsx or csv file from wordpress dashboard > uploaded files.

   Read on wp.org ↗
4. ★★★★★ humananimal

   2.8y ago

   thank you for this!!

   Read on wp.org ↗
5. ★★★★★ Marcel

   3.0y ago

   The plugin is well-written and has a clean, logical interface. I am using it primarily for its webcam support, and it is working very well indeed. There is a currently a problem with uploading the resulting video to Dropbox or Google Drive; however, that is caused by another plugin that has a dependency on an outdated version of Guzzle (an HTTP client). Not only does the plugin work well, but Nickolas, the developer, delivers outstanding support. Highly recommended!

   Read on wp.org ↗
6. ★★★★★ LaurentAnimage

   3.2y ago

   Do exactly what it should ! Very useful with a lot of shortcodes.Support is fast and precise.Very good plug.

   Read on wp.org ↗
7. ★★★★★ kwekli

   3.2y ago

   This plugin is absolutely perfect and has everything one might need, especially in the pro version (awesome features that aren’t in the free version are listed there). If I was making a more serious website than I am currently working on, I’d definitely buy the pro version.

   Read on wp.org ↗
8. ★★★★★ qrmiz

   4.0y ago

   I’m impressed how great this plugin is… There might be some bits glitching, from design perspective, but the overall how it works is just amazing… Good job to the author!!

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 5.1.7 fixed File Overwrite Race Condition when uploading files with the same filename concurrently 5.1.7
2. — Version 5.1.6 verified compatibility with latest 6.9 WordPress version 5.1.6
3. — Version 5.1.5 added support for FTP over TLS (FTPS) uploads 5.1.5
4. — Version 5.1.4 fixed bug where the visual editor throwed warnings for not finding personaldata when Personal Data were deactivated from the plugin’s Settings in Dashboard corrected bug where the upload form visual editor was not openin 5.1.4
5. — Version 5.1.3 removed Post Method setting all GET and POST requests are now executed using the default WordPress functions 5.1.3
6. — Version 5.1.2 improvements on how AJAX endpoint is provided corrections to Requires at lease value replacement of eval() in minification function 5.1.2

All 34 disclosed vulnerabilities are patched in the current version (5.2.2). Sites still on an older version should update.

1. Patched High · 7.5 Iptanus File Upload <= 5.1.10 - Unauthenticated SQL Injection ↗
   2026-10-01 CVE-2026-62071 Improper Neutralization of Special Elements used in an SQL Command Affects <= 5.1.10 Patched in 5.2.0
2. Patched High · 7.5 Iptanus File Upload <= 5.1.7 - Unauthenticated SQL Injection ↗
   2026-08-05 CVE-2026-66447 Improper Neutralization of Special Elements used in an SQL Command Affects <= 5.1.7 Patched in 5.1.8
3. Patched High · 7.5 File Upload <= 5.1.7 - Unauthenticated SQL Injection ↗
   2026-08-03 CVE-2026-17044 Improper Neutralization of Special Elements used in an SQL Command Affects <= 5.1.7 Patched in 5.1.8
4. Patched Medium · 5.3 Iptanus File Upload <= 5.1.6 - Unauthenticated Race Condition to File Overwrite ↗
   2026-05-24 CVE-2025-15546 Concurrent Execution using Shared Resource with Improper Synchronization Affects <= 5.1.6 Patched in 5.1.7
5. Patched Medium · 4.3 WordPress File Upload <= 4.25.2 - Cross-Site Request Forgery in wfu_file_details ↗
   2025-02-24 CVE-2024-13494 Cross-Site Request Forgery Affects <= 4.25.2 Patched in 4.25.3
6. Patched Critical · 9.8 WordPress File Upload <= 4.24.12 - Unuathenticated Remote Code Execution ↗
   2025-01-07 CVE-2024-11635 Improper Control of Generation of Code Affects <= 4.24.12 Patched in 4.24.14
7. Patched Critical · 9.8 WordPress File Upload <= 4.24.15 - Unauthenticated Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion ↗
   2025-01-07 CVE-2024-11613 Improper Control of Generation of Code Affects <= 4.24.15 Patched in 4.25.0
8. Patched High · 7.5 WordPress File Upload <= 4.24.13 - Unauthenticated Path Traversal to Arbitrary File Read in wfu_file_downloader.php ↗
   2025-01-07 CVE-2024-9939 Improper Limitation of a Pathname to a Restricted Directory Affects <= 4.24.13 Patched in 4.24.14
9. Patched Medium · 4.3 WordPress File Upload <= 4.24.15 - Missing Authorization to Authenticated (Subscriber+) Limited Path Traversal ↗
   2025-01-06 CVE-2024-12719 Missing Authorization Affects <= 4.24.15 Patched in 4.25.0
10. Patched Critical · 9.8 WordPress File Upload <= 4.24.11 - Unauthenticated Path Traversal to Arbitrary File Read and Deletion in wfu_file_downloader.php ↗
    2024-10-11 CVE-2024-9047 Improper Limitation of a Pathname to a Restricted Directory Affects <= 4.24.11 Patched in 4.24.12
11. Patched High · 7.2 WordPress File Upload <= 4.24.8 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload ↗
    2024-08-15 CVE-2024-7301 Improper Neutralization of Input During Web Page Generation Affects <= 4.24.8 Patched in 4.24.9
12. Patched Medium · 5.4 WordPress File Upload <= 4.24.7 - Missing Authorization ↗
    2024-08-01 CVE-2024-39639 Missing Authorization Affects <= 4.24.7 Patched in 4.24.8
13. Patched High · 7.2 WordPress File Upload <= 4.24.7 - Unauthenticated Stored Cross-Site Scripting ↗
    2024-07-16 CVE-2024-6494 Improper Neutralization of Input During Web Page Generation Affects <= 4.24.7 Patched in 4.24.8
14. Patched Medium · 6.1 WordPress File Upload <= 4.24.7 - Reflected Cross-Site Scripting ↗
    2024-07-16 CVE-2024-6651 Improper Neutralization of Input During Web Page Generation Affects <= 4.24.7 Patched in 4.24.8
15. Patched Medium · 4.3 WordPress File Upload <= 4.24.7 - Authenticated (Contributor+) Directory Traversal ↗
    2024-07-15 CVE-2024-5852 Improper Limitation of a Pathname to a Restricted Directory Affects <= 4.24.7 Patched in 4.24.8
16. Patched Medium · 6.4 WordPress File Upload <= 4.24.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2024-03-29 CVE-2024-2847 Improper Neutralization of Input During Web Page Generation Affects <= 4.24.5 Patched in 4.24.6
17. Patched Medium · 4.3 Wordpress File Upload 4.24.0 - Cross-Site Request Forgery ↗
    2023-11-14 Cross-Site Request Forgery Affects <= 4.24.0 Patched in 4.24.1
18. Patched Medium · 4.4 Wordpress File Upload <= 4.23.2 - Authenticated(Administrator+) Stored Cross-Site Scripting ↗
    2023-09-12 CVE-2023-4811 Improper Neutralization of Input During Web Page Generation Affects < 4.23.3 Patched in 4.23.3
19. Patched Medium · 4.4 WordPress File Upload / WordPress File Upload Pro <= 4.19.1 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2023-05-23 CVE-2023-2767 Improper Neutralization of Input During Web Page Generation Affects <= 4.19.1 Patched in 4.19.2
20. Patched Medium · 4.9 WordPress File Upload / WordPress File Upload Pro <= 4.19.1 - Authenticated (Administrator+) Path Traversal ↗
    2023-05-23 CVE-2023-2688 Improper Limitation of a Pathname to a Restricted Directory Affects <= 4.19.1 Patched in 4.19.2
21. Patched Medium · 5.4 WordPress File Upload <= 4.16.3 - Cross-Site Scripting ↗
    2022-05-15 Improper Neutralization of Input During Web Page Generation Affects <= 4.16.3 Patched in 4.16.4
22. Patched Medium · 6.5 WordPress File Upload / WordPress File Upload Pro <= 4.16.2 - Authenticated (Contributor+) Path Traversal ↗
    2022-03-01 CVE-2021-24962 Improper Limitation of a Pathname to a Restricted Directory Affects <= 4.16.2 Patched in 4.16.3
23. Patched Medium · 5.4 WordPress File Upload <= 4.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Malicious SVG ↗
    2022-02-14 CVE-2021-24960 Improper Neutralization of Input During Web Page Generation Affects < 4.16.3 Patched in 4.16.3
24. Patched Medium · 5.4 WordPress File Upload <= 4.16.2 - Authenticated Stored Cross-Site Scripting via Shortcode ↗
    2022-02-14 CVE-2021-24961 Improper Neutralization of Input During Web Page Generation Affects < 4.16.3 Patched in 4.16.3
25. Patched Critical · 9.8 WordPress File Upload <= 4.12.2 - Directory Traversal to Remote Code Execution ↗
    2020-03-13 CVE-2020-10564 Improper Limitation of a Pathname to a Restricted Directory Affects <= 4.12.2 Patched in 4.13.0
26. Patched Medium · 6.1 WordPress File Upload <= 4.3.3 - Stored Cross-Site Scripting ↗
    2018-04-06 CVE-2018-9844 Improper Neutralization of Input During Web Page Generation Affects < 4.3.4 Patched in 4.3.4
27. Patched Medium · 4.1 WordPress File Upload <= 4.3.2 - Cross-Site Scripting via Shortcodes ↗
    2018-03-31 CVE-2018-9172 Improper Neutralization of Input During Web Page Generation Affects < 4.3.3 Patched in 4.3.3
28. Patched Critical · 9.8 WordPress File Upload < 3.9.0 - Arbitrary File Upload ↗
    2016-06-23 Unrestricted Upload of File with Dangerous Type Affects < 3.9.0 Patched in 3.9.0
29. Patched Critical · 9.8 WordPress File Upload <= 3.4.0 - Arbitrary File Upload ↗
    2015-10-29 CVE-2015-9341 Unrestricted Upload of File with Dangerous Type Affects < 3.4.1 Patched in 3.4.1
30. Patched Critical · 9.8 WordPress File Upload < 3.0.0 - Arbitrary File Upload ↗
    2015-07-02 CVE-2015-9340 Unrestricted Upload of File with Dangerous Type Affects < 3.0.0 Patched in 3.0.0
31. Patched High · 8.2 WordPress File Upload < 2.7.1 - Arbitrary File Upload ↗
    2015-05-09 CVE-2015-9339 Unrestricted Upload of File with Dangerous Type Affects < 2.7.1 Patched in 2.7.1
32. Patched Critical · 9.8 WordPress File Upload <= 2.4.6 - Arbitrary File Upload ↗
    2015-01-23 CVE-2015-9338 Unrestricted Upload of File with Dangerous Type Affects <= 2.4.6 Patched in 2.5.0
33. Patched Medium · 6.1 WordPress File Upload <= 2.4.3 - Reflected Cross-Site Scripting ↗
    2014-08-20 CVE-2014-125110 Improper Neutralization of Input During Web Page Generation Affects <= 2.4.3 Patched in 2.4.4
34. Patched Medium · 6.3 WordPress File Upload < 2.4.2 - Cross-Site Request Forgery ↗
    2014-08-08 CVE-2014-5199 Cross-Site Request Forgery Affects < 2.4.2 Patched in 2.4.2

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 11 languages, 0 at 90% or more

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Not measured yet for this plugin’s topics. Its tracked searches are not among the measured topics. See the topics measured so far.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2025-10-29 20K+ → 10K+ down after 1263 days in tier
2. 2022-05-15 30K+ → 20K+ down after 602 days in tier
3. 2020-09-20 20K+ → 30K+ up after 1216 days in tier
4. 2017-05-23 10K+ → 20K+ up after 727 days in tier
5. 2015-05-27 9K+ → 10K+ up after 56 days in tier
6. 2015-04-01 8K+ → 9K+ up

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for Iptanus File Upload into a readme, a review or a deck. It updates itself.

Iptanus File Upload: 10K+ active installs, 4.4★ (117 reviews). Plugin Pulse (WP Mayor), as of 2026-10-31. https://plugins.wpmayor.com/plugin/wp-file-upload