CVE-2024-13504

The Shared Files – Frontend File Upload Form & Secure File Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dfxp File uploads in all versions up to, and including, 1.7.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the dfxp file. This issue affects only Apache-based environments, where dfxp files are handled by default.

• CWE-79

• https://plugins.trac.wordpress.org/browser/shared-files/tags/1.7.40
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3231372%40shared-files%2Ftrunk&old=3229309%40shared-files%2Ftrunk&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/9f4210a0-5448-4ff6-876a-37db4ad9b23a?source=cve

Published

Jan 31, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-13499The The GamiPress – Gamification plugin to reward points, ac…7.3
• CVE-2024-1350Missing Authorization vulnerability in Prasidhda Malla Honey…5.3
• CVE-2024-13500The WP Project Manager – Task, team, and project management …6.5
• CVE-2024-13501The WP-FormAssembly plugin for WordPress is vulnerable to St…5.4
• CVE-2024-13502Improper Neutralization of Special Elements used in an OS Co…9.3
• CVE-2024-13503Buffer Copy without Checking Size of Input ('Classic Buffer …9.5
• CVE-2024-13505The Survey Maker plugin for WordPress is vulnerable to Store…4.8
• CVE-2024-13506The GeoDirectory – WP Business Directory Plugin and Classifi…6.4
• CVE-2024-13507The GeoDirectory – WP Business Directory Plugin and Classifi…7.5
• CVE-2024-13508The Booking Package plugin for WordPress is vulnerable to Re…6.1
• CVE-2024-13509The WS Form LITE and PRO plugins for WordPress are vulnerabl…6.1
• CVE-2024-1351Under certain configurations of --tlsCAFile and tls.CAFile, …9.8