Filr – Secure document library WordPress Plugin

Filr – Secure document library

Filr – Secure document library is a WordPress plugin with the following stats:

#3,586 Global Rank

700+ active installs

4.6/5 16 ratings

Since 2020 6 years active

Vulnerabilities

8 Total

8 Patched

0 Active

100% Resolved rate

Filr – Secure document library <= 1.2.13 - Authenticated (Contributor+) Arbitrary File Uploads

CWE-434 · Unrestricted Upload of File with Dangerous Type

The Filr – Secure document library plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.2.13. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

8.8 High Affected All – 1.2.13 Patched in ✓ 1.2.14 Published 26 Feb 2026 CVE CVE-2026-28133

Filr – Secure document library <= 1.2.11 - Authenticated (Administrator+) Stored Cross-Site Scripting via HTML Upload

CWE-434 · Unrestricted Upload of File with Dangerous Type

The Filr – Secure document library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via unrestricted file upload in all versions up to, and including, 1.2.11 due to insufficient file type restrictions in the FILR_Uploader class. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload malicious HTML files containing JavaScript that will execute whenever a user accesses the uploaded file, granted they have permission to create or edit posts with the 'filr' post type.

4.4 Medium Affected All – 1.2.11 Patched in ✓ 1.2.12 Published 16 Jan 2026 CVE CVE-2025-14632

Filr <= 1.2.10 - Authenticated (Contributor+) Arbitrary File Deletion

CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The Filr – Secure document library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in a function in all versions up to, and including, 1.2.10. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

8.1 High Affected All – 1.2.10 Patched in ✓ 1.2.11 Published 17 Aug 2025 CVE CVE-2025-64230

Filr – Secure document library <= 1.2.4 - Authenticated (Editor+) Stored Cross-Site Scripting

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The Filr – Secure document library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

4.4 Medium Affected All – 1.2.4 Patched in ✓ 1.2.5 Published 9 Aug 2024 CVE CVE-2024-43216

Filr – Secure document library <= 1.2.3.5 - Authenticated (Author+) Arbitrary File Upload

CWE-94 · Improper Control of Generation of Code ('Code Injection')

The Filr – Secure document library plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to 1.2.3.5 (inclusive). This makes it possible for authenticated attackers, with author-level or above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

8.8 High Affected All – 1.2.3.6 Patched in ✓ 1.2.3.6 Published 13 Nov 2023 CVE CVE-2023-5762

Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The Freemius SDK for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘fs_request_get’ function in versions up to, and including, 2.5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

6.1 Medium Affected All – 1.2.2.9 Patched in ✓ 1.2.3 Published 18 Jul 2023 CVE CVE-2023-33999

Filr – Secure document library <= 1.2.2 - Missing Authorization

CWE-862 · Missing Authorization

The Filr WordPress plugin before 1.2.2.1 does not have authorisation check in two of its AJAX actions, allowing them to be called by any authenticated users, such as subscriber. They are are protected with a nonce, however the nonce is leaked on the dashboard. This could allow them to upload arbitrary HTML files as well as delete all files or arbitrary ones.

6.4 Medium Affected All – 1.2.2.1 Patched in ✓ 1.2.2.1 Published 23 May 2022 CVE CVE-2022-1777

Freemius SDK <= 2.4.2 - Missing Authorization Checks

CWE-862 · Missing Authorization

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.

6.3 Medium Affected All – 1.2.1 Patched in ✓ 1.2.1 Published 4 Mar 2022 CVE CVE-2022-4974

About Filr – Secure document library

Easily Create a Secure Document Library with Filr

Filr helps you safely upload, organize, and share documents on your site. Use direct links or show all files in a library for easy access.

Filr Pro – advanced features available after making a purchase

Enhanced File Security & Access Control
– Support for external files.
– Restrict file access by user email or user role.
– Encrypt filenames for extra privacy.
– Password-protected ZIP files.

Flexible File Expiry Options
– Expire uploads after a set number of downloads.
– Set an expiration date for files to auto-remove access.

Advanced Upload & Storage Management
– Upload multiple files at once and automatically zip them.
– Store files in custom directories for better organization.
– Manage folders efficiently with built-in folder management.

Extended Shortcode Customization
– More options to configure, style, and customize document library shortcodes.

Get it now on wpdocumentlibrary.com

Documentation

Learn more about this plugin [in our official documentation]](https://wpdocumentlibrary.com/kb/)

Support

Free users: Ask in our forum
Pro users: Get priority help

Frequently Asked Questions

How do I use Filr

After installation and activation go to Filr -> Settings and configure your uploads folder and check the server settings.
When you are done, create your first file with “New File”, give it a title, upload your file and after saving it you can copy the download link.
Otherwise assign it to a library and copy the shortcode to display it on your website.

Can I use Filr in multiple languages

Filr is completely translatable with WPML and Polylang.
Simply use the language switcher and translate all settings.

Where do I report security bugs found in this plugin?

Please report security bugs found in the source code of the Filr plugin through the Patchstack Vulnerability Disclosure Program. The Patchstack team will assist you with verification, CVE assignment, and notify the developers of this plugin.”

Changelog

1.2.15 – 30.07.2026

Fix: Security issue with file permissions checks.
Fix: Text domain changed from “filr” to “filr-protection” to match the plugin slug.

1.2.14 – 06.03.2026

Fix: Security issue with file uploads.

1.2.13 – 05.03.2026

Fix: Preview file with secure download link.

1.2.12 – 22.12.2025

Fix: Security issue with file uploads.

1.2.11 – 22.10.2025

Fix: Security issue with file uploads.

1.2.10 – 11.07.2025

Fix: Undefined variable $timestamp issue.

1.2.9 – 26.06.2025

Fix: Resolved an issue with assets not being loaded properly

1.2.8 – 20.06.2025

Fix: Resolved an issue where hovering over the preview icon for non-image files displayed a broken image tooltip.
Change: Clicking the preview icon now opens the file in a new browser tab for improved usability.

1.2.7 – 03.02.2025

Fixed: Fatal error when creating a new file if …/wp-content/uploads/filr/ directory was missing.

1.2.6 – 06.12.2024

Changed: Update readme

1.2.5

latest Freemius SDK
fixed security issue with insecure filenames
updated docs and support links
enhanced CPT capabilities checks for better security

1.2.4

removed capability check to avoid empty libraries

1.2.3.9

improved title escaping
added capability checks for admin settings + CPT access
force int for ID usage

1.2.3.8

security improvements
WP 6.5 compatibility

1.2.3.7

SDK upgrade
readme improvements

1.2.3.6

WordPress 6.4 compatibility

1.2.3.5

expired download 0 <= comparison
improved expired download handling

1.2.3.4

fixed security issue with file uploads
fixed PHP notice with file link
fixed decrease download count detection
upgraded Freemius SDK

1.2.3.3

WP 6.3 compatibility

1.2.3.2

improved Freemius integration
added filter to change filename

1.2.3.1

Fixed frontend uploader upload to specific folder

1.2.3

added filter filr_access_allowed to allow implementing custom validation for file access
Freemius SDK update to 2.5.10

1.2.2.9

updated uploader scripts
fixed publish date in folders
check for file_exists before getting file size

1.2.2.8

clear filename on reload within frontend uploader
fixed secure URLs with folders

1.2.2.7

fixed size calculation from admin uploads

1.2.2.6

auto-zip for frontend uploads
fixed secure URL feature with frontend uploads
improved visibilty for frontend uploads

1.2.2.5

bugfix: reload with frontend upload
auto-zip for frontend uploads to prevent missing meta on failed ajax requests
Norwegian translation

1.2.2.4

removed unknown method from create post

1.2.2.3

prevent recursion on zipping files in admin

1.2.2.2

added filter to dynamically add custom rows in a library
added dynamic version number
improved accessibility with ARIA tags (frontend & backend)
added option to set a custom error message for unallowed access
cleaned up CSS defaults
improved responsive design (tables and folders)
improved frontend uploader capabilities (library condition, fixed user role parameter)
changed “Rows” to “Columns” – typo
updated translations