Iptanus File Upload
by nickboss · Forms
Front-end file upload forms for WordPress. Build them visually, add your own fields, and capture photos from a webcam.
Try it live opens a temporary test site in your browser, which can take about 20 seconds to load. Plugins that rely on outside services or a full server may not work completely there.
Health
A 86/100
no flags
Active installs
10K+
≈17K estimated
Momentum
+161%
downloads vs prior 30d
Biggest opportunity: Swap “user uploads” for “file upload forms”. “user uploads” isn't earning its slot: it only gets you to #11. “file upload forms” sits at #4 untagged, close enough for a declared tag to move it up. All five slots are taken, so one has to go.
86 health vs 65 average across 2,510 Forms plugins
Install conversion
How it's measured →0.7%
of downloads still active
At least 10K of 1.5M lifetime downloads are still running, below its category: the median Forms plugin keeps 1.3%, across 1,667 plugins.
Downloads count every update, not just first installs, so older and more frequently released plugins read lower. Compare against other Forms plugins, not across the directory. wp.org reports active installs as the bottom of a band, so the real rate is this or higher.
This plugin shipped 10 releases in the last 12 months, and every existing install that updated counted as another download. wp.org publishes no split between first installs and updates, so we show the raw rate rather than guess at one.
Details
Directory ranking optimization
How it's scored →How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.
Excellent listing optimization
Well tuned across the board
Updated 2 days ago
Tested up to WordPress 7.1.4, the current branch or newer
4.4★ over 117 reviews, smoothed to 4.31★
5 of 5 tags set · short description in place
1 of 1 support threads resolved in the last 2 months
Search visibility
How it's tracked →Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.
60
Momentum
Gaining ground
+1.7
Velocity
places per keyword, 28d
58%
Breadth
of keywords climbing, 28d
+1.8
Acceleration
recent half vs earlier
wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.
| Keyword | wp.org | On merit | wp.org move, 90 days |
|---|---|---|---|
| front end upload your tag | #2 | #2 | 0 |
| file upload your tag | #2 | #2 | up 2 |
| upload | #3 | #2 | up 5 |
| file upload forms | #4 | #4 | up 2 |
| webcam your tag | #4 | #1 | up 1 |
| woocommerce file upload | #2 | #1 | up 2 |
| s3 file upload | #2 | #2 | up 2 |
| no po file | #2 | #2 | — |
| upload form your tag | #7 | #8 | up 6 |
| file | #10 | #11 | up 3 |
| user uploads your tag | #11 | #11 | up 7 |
| large file upload | #5 | #6 | down 1 |
| upload plugins | #5 | #4 | up 6 |
| file uploads | #5 | #4 | up 2 |
| file upload size | #5 | #6 | up 2 |
| multiple file upload | #6 | #7 | 0 |
| upload file limit | #6 | #8 | 0 |
| simple upload | #6 | #5 | up 7 |
| upload file size | #6 | #6 | up 2 |
| upload file | #7 | #9 | 0 |
225 searches this plugin appeared in over the last 90 days, 20 listed. 196 left out as unrelated or noise (years, numbers, stray words).
What to do about it
- Swap “user uploads” for “file upload forms”. “user uploads” isn't earning its slot: it only gets you to #11. “file upload forms” sits at #4 untagged, close enough for a declared tag to move it up. All five slots are taken, so one has to go.
- One page off on “user uploads”. #11 puts you just past the first ten results, where almost all the clicks stop. The gap to close is small.
Daily downloads
Since 5 Oct 2022 · 1,488 days · wp.org + Plugin Pulse archive
30-day downloads
Rolling 30-day volume · peak 41.4K · peaks are release surges
Directory rank vs rivals
wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you
Rating trend
Star average over time · dips mark rough releases
Health trend
Composite health score, snapshotted daily
Update activity
How busy the existing users are, measured as downloads in the last 30 days for every 1,000 active sites. A spike means a new release everyone's pulling; a long, slow decline means an aging user base that updates less.
Release cadence
Actively maintainedHow often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.
10
releases in the last 12 months
2d ago
latest release · v5.2.2 · 29 Oct 2026
153
tagged releases on record
Recent releases
What its installed base runs
via wordpress.orgShare of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.
Estimated active installs
The public count shows “10K+”. Our estimate pins where the real number sits.
Crossed into this band 12 months ago; the previous band took 3.5 years to cross, which places it about 71% of the way through.
Install history since 13 Feb 2020
Recent reviews
All reviews on wp.org ↗- ★★★★★ Moveksdizajn9mo ago
so simple and works good
Read on wp.org ↗ - ★★★★★ laurendev1.8y ago
I was looking for a simple plugin for users to upload a singular jpeg or PDF to my website. This plugin rejects every file that is uploaded. I tried uploading several different types (jpeg, PDF and .doc) and it rejected all of them, saying each one was suspicious. The way around this according to the plugin page is to set up the Quarantine feature. But of course the quarantine feature is only possible by upgrading to the Premium version, rendering this app completely useless unless you pay to upgrade.
Read on wp.org ↗ - ★★★★★ revayatejahad2.5y ago
Thank you very much for your great work! well done! I have some issue with the plugin and It would be great if you help me with them as soon as possible. first of all, I use the plugin inside Gravity form and I want the uploaded link could be saved with the form entry! I’ve tried different ways but didn’t come with the result! finally I just added the %pathfile% in the comment below when file successfully uploaded as a way to see the uploaded link but I want this path be saved some where with the form. but the link will disappears when we move to next page or next file upload! secondly, in wordpress dashboard > uploaded files, it doesn’t show the file path with the domain name of ftp server but it shows the direct ftp address to the file which is not wanted! thirdly, It would be great if the plugin asks the domain name and replace it with the ftp file address at the beginning of each file link. lastly, it would be fantastic if the (uploaded files)’s links and names could be exported in an xlsx or csv file from wordpress dashboard > uploaded files.
Read on wp.org ↗ - ★★★★★ humananimal2.8y ago
thank you for this!!
Read on wp.org ↗ - ★★★★★ Marcel3.0y ago
The plugin is well-written and has a clean, logical interface. I am using it primarily for its webcam support, and it is working very well indeed. There is a currently a problem with uploading the resulting video to Dropbox or Google Drive; however, that is caused by another plugin that has a dependency on an outdated version of Guzzle (an HTTP client). Not only does the plugin work well, but Nickolas, the developer, delivers outstanding support. Highly recommended!
Read on wp.org ↗ - ★★★★★ LaurentAnimage3.2y ago
Do exactly what it should ! Very useful with a lot of shortcodes.Support is fast and precise.Very good plug.
Read on wp.org ↗ - ★★★★★ kwekli3.2y ago
This plugin is absolutely perfect and has everything one might need, especially in the pro version (awesome features that aren’t in the free version are listed there). If I was making a more serious website than I am currently working on, I’d definitely buy the pro version.
Read on wp.org ↗ - ★★★★★ qrmiz4.0y ago
I’m impressed how great this plugin is… There might be some bits glitching, from design perspective, but the overall how it works is just amazing… Good job to the author!!
Read on wp.org ↗
Latest updates
via wp.org changelogRecent releases and news for this plugin
- — Version 5.1.7 fixed File Overwrite Race Condition when uploading files with the same filename concurrently 5.1.7
- — Version 5.1.6 verified compatibility with latest 6.9 WordPress version 5.1.6
- — Version 5.1.5 added support for FTP over TLS (FTPS) uploads 5.1.5
- — Version 5.1.4 fixed bug where the visual editor throwed warnings for not finding personaldata when Personal Data were deactivated from the plugin’s Settings in Dashboard corrected bug where the upload form visual editor was not openin 5.1.4
- — Version 5.1.3 removed Post Method setting all GET and POST requests are now executed using the default WordPress functions 5.1.3
- — Version 5.1.2 improvements on how AJAX endpoint is provided corrections to Requires at lease value replacement of eval() in minification function 5.1.2
Security history
via Wordfence IntelligenceAll 34 disclosed vulnerabilities are patched in the current version (5.2.2). Sites still on an older version should update.
- 2026-10-01 CVE-2026-62071 Improper Neutralization of Special Elements used in an SQL Command Affects <= 5.1.10 Patched in 5.2.0
- 2026-08-05 CVE-2026-66447 Improper Neutralization of Special Elements used in an SQL Command Affects <= 5.1.7 Patched in 5.1.8
- 2026-08-03 CVE-2026-17044 Improper Neutralization of Special Elements used in an SQL Command Affects <= 5.1.7 Patched in 5.1.8
- Patched Medium · 5.3 Iptanus File Upload <= 5.1.6 - Unauthenticated Race Condition to File Overwrite ↗2026-05-24 CVE-2025-15546 Concurrent Execution using Shared Resource with Improper Synchronization Affects <= 5.1.6 Patched in 5.1.7
- Patched Medium · 4.3 WordPress File Upload <= 4.25.2 - Cross-Site Request Forgery in wfu_file_details ↗
- 2025-01-07 CVE-2024-11635 Improper Control of Generation of Code Affects <= 4.24.12 Patched in 4.24.14
- Patched Critical · 9.8 WordPress File Upload <= 4.24.15 - Unauthenticated Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion ↗2025-01-07 CVE-2024-11613 Improper Control of Generation of Code Affects <= 4.24.15 Patched in 4.25.0
- Patched High · 7.5 WordPress File Upload <= 4.24.13 - Unauthenticated Path Traversal to Arbitrary File Read in wfu_file_downloader.php ↗2025-01-07 CVE-2024-9939 Improper Limitation of a Pathname to a Restricted Directory Affects <= 4.24.13 Patched in 4.24.14
- Patched Critical · 9.8 WordPress File Upload <= 4.24.11 - Unauthenticated Path Traversal to Arbitrary File Read and Deletion in wfu_file_downloader.php ↗2024-10-11 CVE-2024-9047 Improper Limitation of a Pathname to a Restricted Directory Affects <= 4.24.11 Patched in 4.24.12
- Patched High · 7.2 WordPress File Upload <= 4.24.8 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload ↗2024-08-15 CVE-2024-7301 Improper Neutralization of Input During Web Page Generation Affects <= 4.24.8 Patched in 4.24.9
- 2024-07-16 CVE-2024-6494 Improper Neutralization of Input During Web Page Generation Affects <= 4.24.7 Patched in 4.24.8
- 2024-07-16 CVE-2024-6651 Improper Neutralization of Input During Web Page Generation Affects <= 4.24.7 Patched in 4.24.8
- Patched Medium · 4.3 WordPress File Upload <= 4.24.7 - Authenticated (Contributor+) Directory Traversal ↗2024-07-15 CVE-2024-5852 Improper Limitation of a Pathname to a Restricted Directory Affects <= 4.24.7 Patched in 4.24.8
- Patched Medium · 6.4 WordPress File Upload <= 4.24.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗2024-03-29 CVE-2024-2847 Improper Neutralization of Input During Web Page Generation Affects <= 4.24.5 Patched in 4.24.6
- 2023-11-14 Cross-Site Request Forgery Affects <= 4.24.0 Patched in 4.24.1
- Patched Medium · 4.4 Wordpress File Upload <= 4.23.2 - Authenticated(Administrator+) Stored Cross-Site Scripting ↗2023-09-12 CVE-2023-4811 Improper Neutralization of Input During Web Page Generation Affects < 4.23.3 Patched in 4.23.3
- Patched Medium · 4.4 WordPress File Upload / WordPress File Upload Pro <= 4.19.1 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗2023-05-23 CVE-2023-2767 Improper Neutralization of Input During Web Page Generation Affects <= 4.19.1 Patched in 4.19.2
- Patched Medium · 4.9 WordPress File Upload / WordPress File Upload Pro <= 4.19.1 - Authenticated (Administrator+) Path Traversal ↗2023-05-23 CVE-2023-2688 Improper Limitation of a Pathname to a Restricted Directory Affects <= 4.19.1 Patched in 4.19.2
- 2022-05-15 Improper Neutralization of Input During Web Page Generation Affects <= 4.16.3 Patched in 4.16.4
- Patched Medium · 6.5 WordPress File Upload / WordPress File Upload Pro <= 4.16.2 - Authenticated (Contributor+) Path Traversal ↗2022-03-01 CVE-2021-24962 Improper Limitation of a Pathname to a Restricted Directory Affects <= 4.16.2 Patched in 4.16.3
- Patched Medium · 5.4 WordPress File Upload <= 4.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Malicious SVG ↗2022-02-14 CVE-2021-24960 Improper Neutralization of Input During Web Page Generation Affects < 4.16.3 Patched in 4.16.3
- Patched Medium · 5.4 WordPress File Upload <= 4.16.2 - Authenticated Stored Cross-Site Scripting via Shortcode ↗2022-02-14 CVE-2021-24961 Improper Neutralization of Input During Web Page Generation Affects < 4.16.3 Patched in 4.16.3
- Patched Critical · 9.8 WordPress File Upload <= 4.12.2 - Directory Traversal to Remote Code Execution ↗2020-03-13 CVE-2020-10564 Improper Limitation of a Pathname to a Restricted Directory Affects <= 4.12.2 Patched in 4.13.0
- 2018-04-06 CVE-2018-9844 Improper Neutralization of Input During Web Page Generation Affects < 4.3.4 Patched in 4.3.4
- 2018-03-31 CVE-2018-9172 Improper Neutralization of Input During Web Page Generation Affects < 4.3.3 Patched in 4.3.3
- 2016-06-23 Unrestricted Upload of File with Dangerous Type Affects < 3.9.0 Patched in 3.9.0
- 2015-10-29 CVE-2015-9341 Unrestricted Upload of File with Dangerous Type Affects < 3.4.1 Patched in 3.4.1
- 2015-07-02 CVE-2015-9340 Unrestricted Upload of File with Dangerous Type Affects < 3.0.0 Patched in 3.0.0
- 2015-05-09 CVE-2015-9339 Unrestricted Upload of File with Dangerous Type Affects < 2.7.1 Patched in 2.7.1
- 2015-01-23 CVE-2015-9338 Unrestricted Upload of File with Dangerous Type Affects <= 2.4.6 Patched in 2.5.0
- 2014-08-20 CVE-2014-125110 Improper Neutralization of Input During Web Page Generation Affects <= 2.4.3 Patched in 2.4.4
Vulnerability records provided by Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. License and terms.
CVE records: Copyright 1999-2026 The MITRE Corporation. CVE terms of use.
Behavioral tests
via WP HiveAutomated install-time checks, tested on PHP 8.1.12 · WP 7.0.1
Languages
via translate.wordpress.orgTranslated into 11 languages, 0 at 90% or more
AI assistants
How it's measured →Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.
Not measured yet for this plugin’s topics. Its tracked searches are not among the measured topics. See the topics measured so far.
Readme readiness
7 of 8 pass · checked 26 Oct 2026Can an assistant quote this readme? Eight deterministic checks over the wp.org listing, no model involved.
- ✓ Says what it does "Front-end file upload forms for WordPress. Build them visually, add your own fields, and capture photos fro..."
- ✓ Has a FAQ 17 questions in the FAQ.
- ✓ FAQ asks real questions 17 of 17 read like questions a user would type.
- ! Names who it is for Never says who the plugin is for or what they use it for.
- ✓ Names what it works with Mentions Amazon S3, Dropbox, Google Drive, OneDrive.
- ✓ Headings and lists 3 headings and 2 lists.
- ✓ Enough to quote 5,034 characters of description.
- ✓ Tags match the text 3 of 5 tags appear in the text; "Front end upload", "user uploads" do not.
Growth timeline
Install-tier crossings we have observed, and how long each tier took to outgrow
- 2025-10-29 20K+ → 10K+ down after 1263 days in tier
- 2022-05-15 30K+ → 20K+ down after 602 days in tier
- 2020-09-20 20K+ → 30K+ up after 1216 days in tier
- 2017-05-23 10K+ → 20K+ up after 727 days in tier
- 2015-05-27 9K+ → 10K+ up after 56 days in tier
- 2015-04-01 8K+ → 9K+ up
Competes with
The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).
-
File Upload Types by WPForms 40K+ installs · 3.9★ · 1 shared tag A -
HTML Forms – Simple WordPress Forms Plugin 10K+ installs · 4.8★ · 1 shared tag A -
File Uploads Addon for WooCommerce 4K+ installs · 3.8★ · 1 shared tag B -
Shared Files – File Upload & Download Manager 4K+ installs · 4.3★ · 1 shared tag A -
User Private Files – Secure File Sharing and Client Portal Plugin 1K+ installs · 4.3★ · 1 shared tag A -
File Upload For WPForms – Filenzo 1K+ installs · 4.6★ · 1 shared tag A
Embed this report card
Drop a live Pulse card for Iptanus File Upload into a readme, a review or a deck. It updates itself.
<iframe src="https://plugins.wpmayor.com/embed/wp-file-upload" width="480" height="300" style="border:0" loading="lazy" title="Iptanus File Upload — Plugin Pulse"></iframe> Iptanus File Upload: 10K+ active installs, 4.4★ (117 reviews). Plugin Pulse (WP Mayor), as of 2026-10-31. https://plugins.wpmayor.com/plugin/wp-file-upload
Spotted a number that looks wrong? Report a data issue and we'll check it against the source.