The Shared Files – Frontend File Upload Form & Secure File Sharing WordPress plugin accepts HTML file uploads without properly sanitizing user content before storing or serving the file. As a result, an attacker can upload a maliciously crafted HTML file that contains executable scripts. When any visitor opens the file, the embedded script runs in their browser, creating a classic stored Cross‑Site Scripting attack. This can lead to session hijacking, credential theft, defacement of the site, or delivery of more sophisticated malware payloads.

All WordPress sites that have installed anssilaitila:Shared Files – Frontend File Upload Form & Secure File Sharing plugin version 1.7.48 or earlier are vulnerable. The flaw exists in every version up to and including 1.7.48, regardless of configuration, because the sanitize_file() function fails to encode or escape HTML contents before saving the file.

The CVSS score of 7.2 reflects a high severity from a technical standpoint, while the EPSS score of less than 1% indicates that the likelihood of exploitation is currently low. The vulnerability is not documented in the CISA KEV catalog, so no widespread exploitation has been reported. An attacker needs only unauthenticated access to the public upload form to create a malicious HTML file; any subsequent visitor to that file will trigger the stored XSS. The lack of authentication requirement and the ubiquitous nature of the upload feature make the attack vector simple and the impact potentially widespread across the site’s audience.