CVE-2025-14632: Wpchill Filr – Secure Document Library

Medium severity, CVSS 4.4. EPSS: 0.2% chance of exploitation in the next 30 days.

The Filr – Secure document library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via unrestricted file upload in all versions up to, and including, 1.2.11 due to insufficient file type restrictions in the FILR_Uploader class. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload malicious HTML files containing JavaScript that will execute whenever a user accesses the uploaded file, granted they have permission to create or edit posts with the 'filr' post type.

Affected products

• Wpchill Filr – Secure Document Library: up to and including 1.2.11

Published 2026-01-17. Last modified 2026-06-17.