CVE-2026-10093 Overview
CVE-2026-10093 is a Stored Cross-Site Scripting (XSS) vulnerability in the File Sharing & Download Manager – User Private Files plugin for WordPress. The flaw affects all versions up to and including 2.1.6. The plugin fails to sanitize input and escape output for the fldr_ttl parameter. Authenticated attackers with subscriber-level access or above can inject arbitrary JavaScript into stored content. The injected scripts execute in the browser of any user who visits the affected page. The issue is tracked under CWE-79.
Critical Impact
Authenticated subscriber-level attackers can inject persistent JavaScript that executes against any visiting user, enabling session theft, administrative action hijacking, and content defacement on affected WordPress sites.
Affected Products
- File Sharing & Download Manager – User Private Files plugin for WordPress
- All versions up to and including 2.1.6
- Fixed in version 2.1.7
Discovery Timeline
- 2026-06-16 - CVE-2026-10093 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-10093
Vulnerability Analysis
The vulnerability resides in how the User Private Files plugin handles the fldr_ttl (folder title) parameter. The plugin stores user-supplied folder title values without sufficient input sanitization. When the stored value is later rendered in plugin templates such as templates/files-shared.php, templates/files.php, and templates/render.php, the output is not properly escaped. As a result, any HTML or JavaScript embedded in the folder title is rendered as active content in the browser. The Wordfence research team identified this issue and the plugin maintainers patched it in version 2.1.7. See the Wordfence Vulnerability Report for additional context.
Root Cause
The root cause is missing input sanitization on the fldr_ttl parameter and missing output escaping when that value is echoed inside template files. The relevant code paths include inc/functions-folder.php line 463 and the rendering logic referenced in files-shared.php and render.php. The plugin should have applied sanitize_text_field() on input and esc_html() or esc_attr() on output.
Attack Vector
An authenticated attacker with subscriber-level privileges or higher submits a crafted folder title containing JavaScript. The plugin stores the payload in the WordPress database. When an administrator or other user navigates to a page that renders the folder title, the script executes in their authenticated browser session. Because the scope is changed (CVSS S:C), the impact crosses into the administrator's authority. Attackers can use this position to exfiltrate session cookies, perform privileged WordPress REST API calls, or modify site content. The WordPress Changeset #3565400 shows the corrective escaping applied in the fix.
Detection Methods for CVE-2026-10093
Indicators of Compromise
- Folder title values in the wp_postmeta or plugin-specific tables containing <script>, onerror=, onload=, or javascript: strings.
- WordPress audit log entries showing folder creation or rename activity from low-privilege accounts.
- Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after viewing user file pages.
- Unexpected new administrator accounts or modified user roles following access by privileged users.
Detection Strategies
- Query the database for stored folder titles matching common XSS payload patterns and review any matches.
- Inspect HTTP POST requests targeting plugin endpoints that accept the fldr_ttl parameter and look for HTML or script tokens.
- Deploy a Web Application Firewall (WAF) rule that flags script-like content posted to the User Private Files plugin endpoints.
- Monitor browser console errors and Content Security Policy (CSP) violation reports from administrative sessions.
Monitoring Recommendations
- Enable WordPress activity logging to record folder creation and update events along with the originating user account.
- Alert on privilege changes and new administrator account creation events.
- Aggregate web server logs and look for repeated submissions from subscriber-tier accounts to plugin write endpoints.
- Review browser telemetry for unexpected script execution on pages rendered by templates/files.php or templates/files-shared.php.
How to Mitigate CVE-2026-10093
Immediate Actions Required
- Update the File Sharing & Download Manager – User Private Files plugin to version 2.1.7 or later on all WordPress sites.
- Audit existing folder titles for embedded HTML or JavaScript and sanitize or remove malicious entries.
- Review and rotate credentials for any administrator accounts that may have visited compromised pages.
- Restrict new user registrations and subscriber-level account creation until the patch is verified across the environment.
Patch Information
The vendor released version 2.1.7 of the plugin, which adds proper escaping to the affected templates. The fix is documented in WordPress Changeset #3565400 and the version diff between 2.1.6 and 2.1.7. Administrators should apply the update through the WordPress admin dashboard or via WP-CLI.
Workarounds
- Deactivate the User Private Files plugin until the patched version is installed if immediate updating is not possible.
- Restrict folder creation and rename capabilities to trusted roles by adjusting plugin permission settings.
- Deploy a WAF rule that blocks requests containing <script, onerror=, or javascript: in the fldr_ttl parameter.
- Implement a strict Content Security Policy (CSP) that disallows inline scripts on WordPress administrative pages.
# Update the plugin via WP-CLI
wp plugin update user-private-files --version=2.1.7
# Verify the installed version
wp plugin get user-private-files --field=version
# Search the database for stored XSS payloads in folder titles
wp db query "SELECT * FROM wp_postmeta WHERE meta_value LIKE '%<script%' OR meta_value LIKE '%onerror=%';"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
