Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?Shared Filesshared-files-pro
Plugin · shared-files
Shared Files
10 known vulnerabilities on record. Add your version above to see which ones affect you.
Aug 24, 2026Contributor Server Side Request Forgery (SSRF) in Shared Files <= 1.7.69 versions.CVE-2026-78269 · affects up to 1.7.69 · reported by PatchstackMedium 6.4
Contributor Server Side Request Forgery (SSRF) in Shared Files <= 1.7.69 versions.
Jun 15, 2026Unauthenticated Path Traversal in Shared Files <= 1.7.64 versions.CVE-2026-49112 · affects up to 1.7.64 · reported by PatchstackHigh 7.5
Unauthenticated Path Traversal in Shared Files <= 1.7.64 versions.
Mar 26, 2026Shared Files: Allows users with a roleCVE-2025-15433 · fixed in 1.7.58 · reported by WPScanMedium 6.8
The Shared Files WordPress plugin before 1.7.58 allows users with a role as low as Contributor to download any file on the web server (such as wp-config.php) via a path traversal vector
Feb 20, 2026Shared Files: Missing AuthorizationCVE-2024-34438 · affects up to 1.7.19 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Anssi Laitila Shared Files shared-files.This issue affects Shared Files: from n/a through <= 1.7.19.
Jun 3, 2025Shared Files – Frontend File Upload Form & Secure File Sharing: Stored Cross-Site ScriptingCVE-2025-4392 · affects up to 1.7.48 · reported by WordfenceHigh 7.2
The Shared Files – Frontend File Upload Form & Secure File Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via html File uploads in all versions up to, and including, 1.7.48 due to insufficient input sanitization and output escaping within the sanitize_file() function. This makes it possible for unauthenticated attackers to bypass the plugin’s MIME-only checks and inject arbitrary web scripts in pages that will execute whenever a user accesses the html file.
Jan 31, 2025Shared Files – Frontend File Upload Form & Secure File Sharing: Stored Cross-Site ScriptingCVE-2024-13504 · affects up to 1.7.42 · reported by WordfenceHigh 7.2
The Shared Files – Frontend File Upload Form & Secure File Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dfxp File uploads in all versions up to, and including, 1.7.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the dfxp file. This issue affects only Apache-based environments, where dfxp files are handled by default.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 26, 2024Shared Files: Insertion of Sensitive Information Into Sent DataCVE-2024-43230 · affects up to 1.7.28 · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in Anssi Laitila Shared Files shared-files.This issue affects Shared Files: from n/a through <= 1.7.28.
Apr 23, 2024Shared Files: Missing AuthorizationCVE-2024-32679 · affects up to 1.7.16 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Anssi Laitila Shared Files shared-files.This issue affects Shared Files: from n/a through <= 1.7.16.
Oct 16, 2023Shared Files: Does not return the right Content-Type header for the specified uploaded fileCVE-2023-4819 · fixed in 1.7.6 · reported by WPScanMedium 6.1
The Shared Files WordPress plugin before 1.7.6 does not return the right Content-Type header for the specified uploaded file. Therefore, an attacker can upload an allowed file extension injected with malicious scripts.
Nov 17, 2021Shared Files: Does not sanitise and escape the Download Counter Text settingsCVE-2021-24856 · fixed in 1.6.61 · reported by WPScanMedium 4.8
The Shared Files WordPress plugin before 1.6.61 does not sanitise and escape the Download Counter Text settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.