WordPress plugin
User Private Files – Secure File Sharing and Client Portal Plugin security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 10 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High1
- Medium9
- Low0
All User Private Files – Secure File Sharing and Client Portal Plugin vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium4.3 | Authenticated (Subscriber+) Information Exposure ≤2.1.8Update to 2.1.9 | CVE-2026-97331 | |
| Medium5.3 | Missing Authorization ≤2.1.0Update to 2.2.0 | CVE-2026-97332 | |
| Medium6.4 | Authenticated (Subscriber+) Stored Cross-Site Scripting via 'fldr_ttl' Parameter ≤2.1.6Update to 2.1.7 | CVE-2026-10093 | |
| Medium6.4 | Authenticated (Subscriber+) Stored Cross-Site Scripting ≤2.1.3Update to 2.1.4 | CVE-2024-13799 | |
| Medium4.3 | Insecure Direct Object Reference to Authenticated (Subscriber+) Private File Access ≤2.1.0Update to 2.1.1 | CVE-2024-7848 | |
| Medium5.3 | Insecure Direct Object Reference <2.0.5Update to 2.0.5 | CVE-2023-4836 | |
| Medium4.4 | Authenticated (Admin+) Stored Cross-Site Scripting ≤2.0.3Update to 2.0.4 | CVE-2023-4636 | |
| Medium6.3 | Missing Authorization ≤1.1.1Update to 1.1.2 | — | |
| Medium5.3 | Sensitive Information Disclosure ≤1.1.0Update to 1.1.1 | — | |
| High8.8 | Subscriber+ Arbitrary File Upload ≤1.1.2Update to 1.1.3 | CVE-2022-2356 |
- Medium4.3Authenticated (Subscriber+) Information Exposure
≤2.1.8Update to 2.1.9
- Medium5.3Missing Authorization
≤2.1.0Update to 2.2.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'fldr_ttl' Parameter
≤2.1.6Update to 2.1.7
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤2.1.3Update to 2.1.4
- Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Private File Access
≤2.1.0Update to 2.1.1
- Medium5.3Insecure Direct Object Reference
<2.0.5Update to 2.0.5
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤2.0.3Update to 2.0.4
- Medium6.3Missing Authorization
≤1.1.1Update to 1.1.2
- Medium5.3Sensitive Information Disclosure
≤1.1.0Update to 1.1.1
- High8.8Subscriber+ Arbitrary File Upload
≤1.1.2Update to 1.1.3
User Private Files – Secure File Sharing and Client Portal Plugin: common questions
Does User Private Files – Secure File Sharing and Client Portal Plugin have known vulnerabilities?
Yes. VulnCrest Radar lists 10 known vulnerabilities in User Private Files – Secure File Sharing and Client Portal Plugin: 1 high, 9 medium. None are known to affect version null.
How do I check which version of User Private Files – Secure File Sharing and Client Portal Plugin I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent User Private Files – Secure File Sharing and Client Portal Plugin vulnerability?
CVE-2026-97331, published Oct 5, 2026: User Private Files <= 2.1.8 - Authenticated (Subscriber+) Information Exposure. Severity: Medium (CVSS 4.3).
Is any User Private Files – Secure File Sharing and Client Portal Plugin vulnerability listed in CISA KEV?
No. None of the known User Private Files – Secure File Sharing and Client Portal Plugin vulnerabilities is currently listed in the CISA KEV catalog.