Skip to content
Sign in
4.4 Medium

CVE-2025-14632 The Filr – Secure document library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via unrestricted…

Description

The Filr – Secure document library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via unrestricted file upload in all versions up to, and including, 1.2.11 due to insufficient file type restrictions in the FILR_Uploader class. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload malicious HTML files containing JavaScript that will execute whenever a user accesses the uploaded file, granted they have permission to create or edit posts with the 'filr' post type.

Affected products and versions

Product Affected versions Fixed in
Filr – Secure document library 1.2 earliest → 1.2.11 No fix stated

Other CVEs of Filr – Secure document library

The 2 CVEs of Filr – Secure document library →
CVE-2022-4974 The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request… 6.3 Medium
Track this CVE