The vulnerability resides in the File Sharing & Download Manager – User Private Files plugin for WordPress, where the 'fldr_ttl' parameter is stored without proper sanitization. An attacker with subscriber-level or higher access can place malicious script code in this field, which is then rendered on the page each time the folder is viewed. This results in arbitrary script execution in the context of any visitor to that page, potentially enabling session hijacking, keystroke logging, or defacement.

All users running the Secure Client Portal and Private File Sharing Plugin – User Private Files plugin version 2.1.6 or older are affected. The vendor of the plugin is DeepakKite, and the issue specifically targets its file‑sharing module. Only the stated versions are impacted; newer releases beyond 2.1.6 are presumed to contain the fix.

The CVSS score of 6.4 indicates a moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers need valid subscriber credentials to modify the folder title, so the exploit is limited to authenticated users with that role. Once injected, the malicious script executes in every user’s browser when the folder page is accessed, providing a persistent cross‑site scripting vector.