CVE-2025-14632: Filr WordPress Plugin XSS Vulnerability

CVE-2025-14632 Overview

The Filr – Secure document library plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via unrestricted file upload in all versions up to, and including, 1.2.11. The vulnerability exists due to insufficient file type restrictions in the FILR_Uploader class, which allows authenticated attackers with Administrator-level access to upload malicious HTML files containing JavaScript. The malicious script executes whenever a user accesses the uploaded file, provided the attacker has permission to create or edit posts with the filr post type.

Critical Impact
Authenticated administrators can upload malicious HTML files that execute JavaScript when accessed by other users, potentially leading to session hijacking, credential theft, or unauthorized actions on behalf of legitimate users.

Affected Products

Filr – Secure document library plugin for WordPress versions up to and including 1.2.11
WordPress installations using the affected Filr plugin versions
Sites where administrators have permission to create or edit posts with the filr post type

Discovery Timeline

2026-01-17 - CVE CVE-2025-14632 published to NVD
2026-01-17 - Last updated in NVD database

Technical Details for CVE-2025-14632

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The root issue lies in the FILR_Uploader class, which fails to properly validate and restrict the types of files that can be uploaded through the plugin's document management interface. While the plugin is designed to handle secure document storage, the file upload functionality does not adequately filter dangerous file types such as HTML files.

When an administrator uploads an HTML file containing embedded JavaScript, the server stores it without proper sanitization. Subsequently, when any user with access to the document library views or downloads the file, the malicious JavaScript executes in their browser context. This attack requires network access and administrative privileges, but can affect users across different privilege levels once the malicious file is in place.

Root Cause

The vulnerability stems from insufficient file type validation in the FILR_Uploader class located at src/class-filr-uploader.php. The upload handler does not implement a proper allowlist of safe file extensions or perform content-type validation to prevent HTML files with embedded scripts from being uploaded. This oversight allows authenticated administrators to bypass intended security controls and store potentially malicious content that affects other users.

Attack Vector

The attack is network-based and requires authentication with Administrator-level privileges. The attack sequence involves:

An attacker with administrator access crafts an HTML file containing malicious JavaScript payloads
The attacker uploads this file through the Filr plugin's document upload functionality
The plugin stores the file without adequate content validation
When other users access or preview the uploaded document, the embedded JavaScript executes in their browser
The malicious script can then steal session cookies, capture credentials, or perform actions on behalf of the victim

The vulnerability is particularly concerning because it exploits a trusted document management system, where users may have a false sense of security when interacting with stored files.

Detection Methods for CVE-2025-14632

Indicators of Compromise

Presence of HTML files with embedded <script> tags in the Filr plugin upload directories
Unexpected JavaScript execution when viewing documents in the Filr library
Suspicious administrator activity involving file uploads with unusual extensions
Browser console errors or network requests to unknown external domains when accessing Filr documents

Detection Strategies

Review uploaded files in the Filr document library for HTML files or files with suspicious content
Implement file integrity monitoring on WordPress upload directories associated with the Filr plugin
Monitor web application firewall logs for attempts to upload files with HTML or JavaScript content
Audit administrator actions in WordPress logs, specifically focusing on file upload activities within the Filr plugin

Monitoring Recommendations

Enable detailed logging for file upload operations within the WordPress environment
Configure alerts for HTML file uploads through the Filr plugin interface
Implement Content Security Policy (CSP) headers to mitigate the impact of stored XSS attacks
Regularly audit the contents of the Filr upload directory for potentially malicious files

How to Mitigate CVE-2025-14632

Immediate Actions Required

Update the Filr – Secure document library plugin to a version newer than 1.2.11 that addresses this vulnerability
Review existing uploaded files in the Filr library for any suspicious HTML content
Restrict administrator access to only trusted personnel until the patch is applied
Implement additional server-side file type validation as a defense-in-depth measure

Patch Information

A security patch addressing this vulnerability is available. The WordPress Changeset Details provides information about the code changes made to resolve this issue. The vulnerable code in the FILR_Uploader class can be reviewed in the WordPress Plugin Source Code. For additional vulnerability details, refer to the Wordfence Vulnerability Report.

Workarounds

Implement server-level file upload restrictions to block HTML files from being uploaded through WordPress
Use a Web Application Firewall (WAF) rule to filter file uploads containing HTML or JavaScript content
Temporarily disable file upload functionality in the Filr plugin until the patch is applied
Configure .htaccess rules to prevent execution of HTML files in the Filr upload directory

bash

# Example .htaccess configuration for Filr upload directory
# Add to wp-content/uploads/filr/.htaccess
<FilesMatch "\.(html|htm|js)$">
    Order Allow,Deny
    Deny from all
</FilesMatch>

# Alternative: Force download instead of browser rendering
<FilesMatch ".*">
    Header set Content-Disposition attachment
</FilesMatch>