CVE-2026-10093: Stored XSS in File Sharing & Download Manager WordPress Plugin

Technical summary

CVE-2026-10093 is a Stored Cross-Site Scripting (XSS) vulnerability in the File Sharing & Download Manager – User Private Files plugin for WordPress, affecting all versions through 2.1.6. The vulnerability stems from insufficient input sanitization and output escaping of the 'fldr_ttl' parameter. Authenticated attackers with subscriber-level or higher privileges can inject arbitrary JavaScript into the application, which persists in the database and executes in the context of other users' browsers when they access an affected page. The CVSS 3.1 score of 6.4 (MEDIUM) reflects network accessibility, low attack complexity, and the requirement for prior authentication, though the impact is limited to confidentiality and integrity without availability compromise.

Business impact

Organizations running affected versions of this plugin face persistent malicious script injection risks. Compromised sites could experience user credential harvesting, unauthorized account access, malware distribution to visitors, or defacement. Since the attack requires authentication, the immediate threat vector is limited to insiders or compromised internal accounts, but the stored nature of the XSS means the payload affects all subsequent visitors, amplifying the blast radius. For multi-user WordPress installations, this creates both reputation and compliance risks.

Affected systems

The File Sharing & Download Manager – User Private Files plugin in all versions up to and including 2.1.6 is vulnerable. This affects WordPress sites using this plugin where subscriber-level or higher user accounts exist. The vulnerability does not require authenticated user interaction (no phishing needed once injected), making it particularly dangerous in shared hosting or multi-tenant WordPress environments.

Exploitability

Exploitation requires valid WordPress credentials at subscriber level or above. No public exploit code is documented in the disclosed information, and the vulnerability is not yet listed on CISA's Known Exploited Vulnerabilities catalog. However, the attack surface is broad: any authenticated user with the required permissions can inject payloads via the 'fldr_ttl' parameter. The low attack complexity and lack of user interaction required for execution post-injection make this a practical threat in environments with loose access controls or compromised user accounts.

Remediation

Update the File Sharing & Download Manager – User Private Files plugin to a version newer than 2.1.6 (verify the specific patched version against the vendor advisory). Alternatively, disable or uninstall the plugin if it is not actively used. For immediate containment, restrict subscriber-level and above user privileges to only those who require them, and monitor user creation and permission grants closely.

Patch guidance

Check the official plugin repository or vendor advisory for the first version after 2.1.6 that includes the fix. Once identified, update through the WordPress plugin dashboard or via command line. Test the update in a staging environment first to ensure compatibility with other plugins and themes. If a patch is not yet available, consider temporarily disabling the plugin while awaiting a release.

Detection guidance

Search WordPress database tables and post metadata for suspicious scripts in the 'fldr_ttl' parameter values. Monitor user account creation and privilege escalation events, particularly for subscriber accounts. Review WordPress access logs for unusual POST requests targeting the plugin's admin handlers. Implement Web Application Firewall (WAF) rules to detect and block script injection patterns in the 'fldr_ttl' parameter. Use WordPress security plugins to audit user permissions and flag suspicious capability assignments.

Why prioritize this

Although the CVSS score is MEDIUM (6.4), this vulnerability warrants prioritization in multi-user WordPress environments or where non-administrator accounts have publishing rights. The stored XSS nature means the payload persists and affects all visitors, and the low attack complexity combined with the common presence of WordPress sites makes it an attractive target. Organizations with strict access controls limiting subscriber permissions may deprioritize slightly, but patching should still occur within a standard update cycle.

Risk score, explained

The CVSS 3.1 score of 6.4 reflects: Network-accessible attack vector, low attack complexity (no special conditions required), requirement for low-level authentication (PR:L), and no user interaction needed post-injection (UI:N). The score is elevated by the Changed Scope (S:C) attribute, indicating the XSS can affect the integrity and confidentiality of other users' sessions. However, it does not reach HIGH or CRITICAL because there is no availability impact and the attack requires prior authentication.

Frequently asked questions