Stored Cross-Site Scripting Vulnerability in User Private Files Plugin for WordPress
CVE-2024-13799

6.4MEDIUM

Key Information:

Vendor
WordPress
Status
User Private Files – File Upload & Download Manager With Secure File Sharing
Vendor
CVE Published:
19 February 2025

Summary

The User Private Files – File Upload & Download Manager with Secure File Sharing plugin for WordPress has a vulnerability that allows authenticated users with Subscriber-level access or higher to execute arbitrary web scripts through the 'new-fldr-name' parameter. This is due to inadequate input sanitization and output escaping, which can lead to the injection of malicious scripts into pages. Users accessing these pages may inadvertently execute harmful scripts, posing significant security risks.

Affected Version(s)

User Private Files – File Upload & Download Manager with Secure File Sharing * <= 2.1.3

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/user-private-f...
https://plugins.trac.wordpress.org/changeset/3240877/

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tim Coen
.