The Filr – Secure document library plugin for WordPress allows an authenticated attacker with Administrator‑level or higher privileges to upload arbitrary files through its FILR_Uploader component. Because the upload path accepts any file type without proper validation, the plugin stores the uploaded content as is. An attacker can upload a malicious HTML file containing embedded JavaScript; when any user with permission to edit or create posts of the 'filr' post type accesses that file, the script executes within their browser context, potentially exfiltrating data or facilitating further attacks. This represents a stored XSS vulnerability (CWE‑434) that can compromise the confidentiality and integrity of the site’s users.

The vulnerability occurs in all releases of the Filr – Secure document library plugin up to and including version 1.2.11. The affected product is the WordPress plugin known as Filr – Secure document library, created by wpchill. No other vendor or product versions are listed as affected.

The CVSS v3.1 score of 4.4 indicates a moderate severity. The EPSS score of less than 1 % suggests that, at the time of assessment, the probability of exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. However, because the flaw only requires legitimate administrator credentials, it is accessible to users who legitimately have such privileges. If such accounts are compromised or if the plugin’s permission checks are inadequate, an attacker could deploy cross‑site scripting attacks on any user who interacts with the uploaded malicious file.