What’s Vulnerable › Vulnerabilities

CVE-2023-4819: Shared Files < 1.7.6 - Unauthenticated Stored Cross-Site Scripting

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-10-16 · updated 2026-06-17

Description

The Shared Files WordPress plugin before 1.7.6 does not return the right Content-Type header for the specified uploaded file. Therefore, an attacker can upload an allowed file extension injected with malicious scripts.

Affected products

• Shared Files: before 1.7.6 — fixed in 1.7.6

How to fix

Upgrade to a fixed version: Shared Files 1.7.6. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/4423b023-cf4a-46cb-b314-7a09ac08b29a
• https://wpscan.com/vulnerability/4423b023-cf4a-46cb-b314-7a09ac08b29a

Get alerted when CVE-2023-4819 or the next vulnerability affects your stack