Is User Private Files safe?

Every recorded flaw

• Oct 7, 2026User Private Files: Does not validate that a supplied user belongs to the document being operated on before returning that user's email addressCVE-2026-97331 · fixed in 2.1.9 · reported by WPScanMedium 4.3
• Oct 4, 2026User Private Files: Does not properly protect its stored private files on multisite installationsCVE-2026-97332 · fixed in 2.2.0 · reported by WPScanMedium 5.3
• Jun 16, 2026File Sharing & Download Manager – User Private Files: Stored Cross-Site ScriptingCVE-2026-10093 · affects up to 2.1.6 · reported by WordfenceMedium 6.4
• Feb 19, 2025User Private Files – File Upload & Download Manager with Secure File Sharing: Stored Cross-Site ScriptingCVE-2024-13799 · affects up to 2.1.3 · reported by WordfenceMedium 6.4
• Aug 22, 2024User Private Files – WordPress File Sharing: Insecure Direct Object ReferenceCVE-2024-7848 · affects up to 2.1.0 · reported by WordfenceMedium 4.3
• Oct 31, 2023WordPress File Sharing: Does not check authorization before displaying files and foldersCVE-2023-4836 · fixed in 2.0.5 · reported by WPScanMedium 4.3
• Sep 4, 2023WordPress File Sharing: Stored Cross-Site ScriptingCVE-2023-4636 · affects up to 2.0.3 · reported by WordfenceMedium 4.4

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.