CVE-2023-4636

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The WordPress File Sharing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
deepakkite	File Sharing & Download Manager – User Private Files	<= 2.0.3

References

https://github.com/xsn1210/vul2/blob/main/xss%5BWordPressFile%5D%20.mdExploit, Third Party Advisory
https://plugins.trac.wordpress.org/changeset/2961909/user-private-filesPatch
https://www.wordfence.com/threat-intel/vulnerabilities/id/1df04293-87e9-4ab4-975d-54d36a993ab0?source=cveThird Party Advisory
https://github.com/xsn1210/vul2/blob/main/xss%5BWordPressFile%5D%20.mdExploit, Third Party Advisory
https://plugins.trac.wordpress.org/changeset/2961909/user-private-filesPatch
https://www.wordfence.com/threat-intel/vulnerabilities/id/1df04293-87e9-4ab4-975d-54d36a993ab0?source=cveThird Party Advisory

Timeline

Published: Sep 5, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-463608.8Hardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier is vulnerable to Execution with Unnecessary Privileges.CVE-2023-463616.5Artifex Software jbig2dec v0.20 was discovered to contain a SEGV vulnerability via jbig2_error at /jbig2dec/jbig2.c.CVE-2023-463625.5jbig2enc v0.28 was discovered to contain a heap-use-after-free via jbig2enc_auto_threshold_using_hash in src/jbig2enc.cc.CVE-2023-463635.5jbig2enc v0.28 was discovered to contain a SEGV via jbig2_add_page in src/jbig2enc.cc:512.CVE-2023-463699.8Tenda W18E V16.01.0.8(1576) contains a stack overflow vulnerability via the portMirrorMirroredPorts parameter in the formSetNetCheckTools fu CVE-2023-46375.3The WPvivid plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the restore() and get_res CVE-2023-463709.8Tenda W18E V16.01.0.8(1576) has a command injection vulnerability via the hostName parameter in the formSetNetCheckTools function.CVE-2023-463719.8TP-Link device TL-WDR7660 2.0.30 and TL-WR886N 2.0.12 has a stack overflow vulnerability via the function upgradeInfoJsonToBin.CVE-2023-463739.8TP-Link TL-WDR7660 2.0.30 has a stack overflow vulnerability via the function deviceInfoJsonToBincauses.CVE-2023-463746.1ZenTao Enterprise Edition version 4.1.3 and before is vulnerable to Cross Site Scripting (XSS).CVE-2023-463758.8ZenTao Biz version 4.1.3 and before is vulnerable to Cross Site Request Forgery (CSRF).CVE-2023-463767.5Zentao Biz version 8.7 and before is vulnerable to Information Disclosure.