CVE-2023-4636

The WordPress File Sharing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

• CWE-79

• https://github.com/xsn1210/vul2/blob/main/xss%5BWordPressFile%5D%20.mdExploit, Third Party Advisory
• https://plugins.trac.wordpress.org/changeset/2961909/user-private-filesPatch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/1df04293-87e9-4ab4-975d-54d36a993ab0?source=cveThird Party Advisory
• https://github.com/xsn1210/vul2/blob/main/xss%5BWordPressFile%5D%20.mdExploit, Third Party Advisory
• https://plugins.trac.wordpress.org/changeset/2961909/user-private-filesPatch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/1df04293-87e9-4ab4-975d-54d36a993ab0?source=cveThird Party Advisory

Published

Sep 5, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-46354In the module "Orders (CSV, Excel) Export PRO" (ordersexport…7.5
• CVE-2023-46355In the module "CSV Feeds PRO" (csvfeeds) < 2.6.1 from Bl Mod…5.3
• CVE-2023-46356In the module "CSV Feeds PRO" (csvfeeds) before 2.6.1 from B…9.8
• CVE-2023-46357In the module "Cross Selling in Modal Cart" (motivationsale)…9.8
• CVE-2023-46358In the module "Referral and Affiliation Program" (referralby…9.8
• CVE-2023-46359An OS command injection vulnerability in Hardy Barth cPH2 eC…9.8
• CVE-2023-46360Hardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier is …8.8
• CVE-2023-46361Artifex Software jbig2dec v0.20 was discovered to contain a …6.5
• CVE-2023-46362jbig2enc v0.28 was discovered to contain a heap-use-after-fr…5.5
• CVE-2023-46363jbig2enc v0.28 was discovered to contain a SEGV via jbig2_ad…5.5
• CVE-2023-46369Tenda W18E V16.01.0.8(1576) contains a stack overflow vulner…9.8
• CVE-2023-4637The WPvivid plugin for WordPress is vulnerable to unauthoriz…5.3