Executive brief
A vulnerability exists in a WordPress plugin used for managing private user files and folders. An attacker with basic user access can inject malicious scripts into the website's pages. When other users or administrators visit those pages, the scripts will run automatically, potentially allowing the attacker to steal session information or perform unauthorized actions on behalf of the victim.
Technical details
The File Sharing & Download Manager – User Private Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'fldr_ttl' parameter. This vulnerability allows authenticated attackers with subscriber-level permissions or higher to inject arbitrary web scripts into the database. These scripts are then executed in the browser of any user who accesses the affected page. The issue is present in all versions up to 2.1.6 and was addressed in version 2.1.7.
Affected products
- WordPress File Sharing & Download Manager – User Private Files up to, and including, 2.1.6
Timeline
- 2026-06-16: disclosed
- 2026-06-16: advisory
References
- https://plugins.trac.wordpress.org/browser/user-private-files/tags/2.1.6/inc/functions-folder.php
- https://plugins.trac.wordpress.org/browser/user-private-files/tags/2.1.6/templates/files-shared.php
- https://plugins.trac.wordpress.org/browser/user-private-files/tags/2.1.6/templates/files-shared.php
- https://plugins.trac.wordpress.org/browser/user-private-files/tags/2.1.6/templates/files.php
- https://plugins.trac.wordpress.org/browser/user-private-files/tags/2.1.6/templates/files.php
- https://plugins.trac.wordpress.org/browser/user-private-files/tags/2.1.6/templates/render.php
- https://plugins.trac.wordpress.org/changeset/3565400/user-private-files/trunk/templates/files-shared.php