Tammersoft Shared Files vulnerabilities

Latest Tammersoft Shared Files CVEs

Newest publication first

1. CVE-2026-78269 WordPress Shared Files plugin <= 1.7.69 - Server Side Request Forgery (SSRF) vulnerability

   Published 2026-08-24

   Medium·CVSS 6.4 EPSS 0.23%

   Contributor Server Side Request Forgery (SSRF) in Shared Files <= 1.7.69 versions.

2. CVE-2026-49112 WordPress Shared Files plugin <= 1.7.64 - Path Traversal vulnerability

   Published 2026-06-15

   High·CVSS 7.5 EPSS 0.33%

   Unauthenticated Path Traversal in Shared Files <= 1.7.64 versions.

3. CVE-2024-43230 WordPress Shared Files – Premium Download Manager & Secure File Sharing with Frontend File Upload plugin <= 1.7.28 - Sensitive Data Exposure vulnerability

   Published 2024-08-26

   High·CVSS 7.5 EPSS 0.37%

   Insertion of Sensitive Information Into Sent Data vulnerability in Anssi Laitila Shared Files shared-files.This issue affects Shared Files: from n/a through <= 1.7.28.

4. CVE-2024-32679 WordPress Shared Files plugin <= 1.7.16 - Broken Access Control vulnerability

   Published 2024-04-23

   Medium·CVSS 5.3 EPSS 0.39%

   Missing Authorization vulnerability in Anssi Laitila Shared Files shared-files.This issue affects Shared Files: from n/a through <= 1.7.16.

5. CVE-2023-4819 Shared Files < 1.7.6 - Unauthenticated Stored Cross-Site Scripting

   Published 2023-10-16

   Medium·CVSS 6.1 EPSS 0.49%

   The Shared Files WordPress plugin before 1.7.6 does not return the right Content-Type header for the specified uploaded file. Therefore, an attacker can upload an allowed file extension injected with malicious scripts.

6. CVE-2021-24856 Shared Files < 1.6.61 - Admin+ Stored Cross-Site Scripting

   Published 2021-11-17

   Medium·CVSS 4.8 EPSS 0.67%

   The Shared Files WordPress plugin before 1.6.61 does not sanitise and escape the Download Counter Text settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

7. CVE-2021-24736 Shared Files < 1.6.57 - Admin+ Stored Cross-Site Scripting

   Published 2021-10-18

   Medium·CVSS 4.8 EPSS 0.64%

   The Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files WordPress plugin before 1.6.57 does not sanitise and escape some of its settings before outputting them in attributes, which could lead to Stored Cross-Site Scripti...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.