WordPress File Sharing & Download Manager <= 2.1.6 Stored XSS (CVE-2026-10093)

Vulnerability Overview Vulnerability Name: File Sharing & Download Manager <= 2.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'fldr_ttl' Parameter Vulnerability Type: Stored Cross-Site Scripting (XSS) CVSS Score: 6.4 (Medium) CVE ID: CVE-2026-10093 Publication Date: June 15, 2026 Last Updated: June 16, 2026 Researcher: pham quang huy (Zibana) Impact Scope Affected Software: File Sharing & Download Manager - User Private Files Affected Versions: <= 2.1.6 Vulnerability Description: The plugin versions 2.1.6 and earlier are vulnerable to arbitrary web script injection via the 'fldr_ttl' parameter due to insufficient input validation and output escaping, affecting users with subscriber-level access and above. Remediation Fixed Version: 2.1.7 Recommendation: Upgrade to version 2.1.7 or higher to fix this vulnerability. Additional Information Reference Links: - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org Related Recent Vulnerabilities User Private Files - File Upload & Download Manager with Secure File Sharing <= 2.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting - CVE ID: CVE-2024-13799 - CVSS Score: 6.4 - Researcher: Tim Coen - Date: February 18, 2025 User Private Files <= 2.1.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private File Access - CVE ID: CVE-2024-7848 - CVSS Score: 4.3 - Researcher: Peter Thielkeis - Date: August 21, 2024 User Private Files <= 2.0.5 - Insecure Direct Object Reference - CVE ID: CVE-2023-4836 - CVSS Score: 5.3 - Researcher: Dmitri Ignatyev - Date: October 11, 2023 WordPress File Sharing Plugin <= 2.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting - CVE ID: CVE-2023-4636 - CVSS Score: 4.4 - Researcher: Shuning Xu - Date: September 4, 2023 Frontend File Manager & Sharing - User Private Files <= 1.1.1 - Missing Authorization - CVE ID: Not Provided - CVSS Score: 6.3 - Researcher: Not Provided - Date: August 6, 2022 Frontend File Manager & Sharing - User Private Files <= 1.1.0 - Sensitive Information Disclosure - CVE ID: Not Provided - CVSS Score: 5.3 - Researcher: Not Provided - Date: August 6, 2022 Frontend File Manager & Sharing - User Private Files <= 1.1.2 - Subscriber+ Arbitrary File Upload - CVE ID: CVE-2022-2356 - CVSS Score: 8.8 - Researcher: Raad Haddad - Date: July 11, 2022 Summary This vulnerability involves a Stored Cross-Site Scripting (XSS) issue in the File Sharing & Download Manager plugin, affecting versions 2.1.6 and earlier. Users are advised to upgrade to version 2.1.7 or higher as soon as possible to remediate this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress File Sharing & Download Manager <= 2.1.6 Stored XSS (CVE-2026-10093)