Vulnerabilities

TI-2026-54441 CVE-2026-78269 · GHSA-fmxw-fw8j-h734

WordPress Shared Files plugin <= 1.7.69 - Server Side Request Forgery (SSRF) vulnerability

LOW 28

Contributor Server Side Request Forgery (SSRF) in Shared Files <= 1.7.69 versions.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0023 Published 2026-08-24 No fix listed CWE-918

TI-2026-36336 CVE-2026-49112 · GHSA-r8mq-gf5f-f3j5

WordPress Shared Files plugin <= 1.7.64 - Path Traversal vulnerability

LOW 39

Unauthenticated Path Traversal in Shared Files <= 1.7.64 versions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00326 Published 2026-06-15 No fix listed CWE-35

TI-2023-04436 CVE-2023-4819 · GHSA-2mh6-g78c-5h6c

Shared Files < 1.7.6 - Unauthenticated Stored Cross-Site Scripting

MEDIUM 60

The Shared Files WordPress plugin before 1.7.6 does not return the right Content-Type header for the specified uploaded file.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00486 Published 2023-10-16 Fixed in 1.7.6

TI-2021-07138 CVE-2021-24856 · GHSA-533w-p83m-xgjp

Shared Files < 1.6.61 - Admin+ Stored Cross-Site Scripting

LOW 23

The Shared Files WordPress plugin before 1.6.61 does not sanitise and escape the Download Counter Text settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_htm…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00668 Published 2021-11-17 Fixed in 1.6.61 CWE-79

TI-2021-07018 CVE-2021-24736 · GHSA-hvpq-m9vj-27gf

Shared Files < 1.6.57 - Admin+ Stored Cross-Site Scripting