CVE-2026-97332

The User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite installations, where the rewrite rule it relies on to route file requests through its access check is never reached, allowing unauthenticated users to retrieve other users' private...

CVE-2026-97332

The User Private Files WordPress plugin, in versions before 2.2.0 , is vulnerable to unauthenticated private file disclosure on multisite installations. The root cause is a rewrite rule bypass where requests to stored private files do not route through the plugin's required access check. This all...

WordPress User Private Files plugin < 2.2.0 - Unauthenticated Private File Disclosure vulnerability

Unauthenticated Private File Disclosure vulnerability discovered by Akshat Parikh SN1PER in WordPress Plugin User Private Files versions 2.2.0...

CVE-2026-97332 User Private Files < 2.2.0 - Unauthenticated Private File Disclosure via .htaccess Rewrite Rule Bypass (Multisite)

The User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite installations, where the rewrite rule it relies on to route file requests through its access check is never reached, allowing unauthenticated users to retrieve other users' private...

EUVD-2026-92076

The User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite installations, where the rewrite rule it relies on to route file requests through its access check is never reached, allowing unauthenticated users to retrieve other users' private...

PT-2026-104611

The User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite installations, where the rewrite rule it relies on to route file requests through its access check is never reached, allowing unauthenticated users to retrieve other users' private...

WordPress Secure Client Portal and Private File Sharing Plugin – User Private Files plugin <= 2.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by pham quang huy Zibanana in WordPress Plugin User Private Files versions = 2.1.6...

CVE-2026-10093: Improper Neutralization of Input During Web Page Generation

The File Sharing & Download Manager – User Private Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fldrttl' parameter in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

EUVD-2024-48699

Malicious code in bioql PyPI...

EUVD-2025-4749

Malicious code in bioql PyPI...

CVE-2024-13799 User Private Files – File Upload & Download Manager with Secure File Sharing <= 2.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting

The User Private Files – File Upload & Download Manager with Secure File Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘new-fldr-name’ parameter in all versions up to, and including, 2.1.3 due to insufficient input sanitization and output escaping. This makes i...

CVE-2024-13799

CVE-2024-13799 affects the WordPress plugin “User Private Files – File Upload & Download Manager with Secure File Sharing”. According to the connected Wordfence entry, it is vulnerable to Stored Cross-Site Scripting via the new-fldr-name parameter in all versions up to and including 2.1.3, caused...

CVE-2024-13799: Improper Neutralization of Input During Web Page Generation

The User Private Files – File Upload & Download Manager with Secure File Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘new-fldr-name’ parameter in all versions up to, and including, 2.1.3 due to insufficient input sanitization and output escaping. This makes i...

WordPress plugin User Private Files 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

WordPress User Private Files – File Upload & Download Manager with Secure File Sharing plugin <= 2.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Tim Coen in WordPress Plugin User Private Files versions = 2.1.3...

CVE-2024-7848 User Private Files <= 2.1.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private File Access

The User Private Files – WordPress File Sharing Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.0 via the 'dpkupvfupdatedoc' due to missing validation on the 'docid' user controlled key. This makes it possible for authenticat...

PT-2024-38626 · WordPress · User Private Files

Name of the Vulnerable Software and Affected Versions: User Private Files – WordPress File Sharing Plugin versions up to, and including, 2.1.0 Description: The issue allows authenticated attackers with subscriber-level access and above to gain access to other users' private files due to missing...

CVE-2024-7848: Authorization Bypass Through User-Controlled Key

The User Private Files – WordPress File Sharing Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.0 via the 'dpkupvfupdatedoc' due to missing validation on the 'docid' user controlled key. This makes it possible for authenticat...

WordPress plugin User Private Files 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability exists in th...

WordPress User Private Files Plugin < 2.0.5 is vulnerable to Insecure Direct Object References (IDOR)

Software User Private Files Type Plugin Vulnerable versions 2.0.5 Fixed in 2.0.5 OWASP Top 10 A3: Injection Classification Insecure Direct Object References IDOR CVE CVE-2023-4836 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 588e3012fbb4 Credits Dmitrii Ignatyev Require...