CVE-2025-14632 affects the wpchill Filr – Secure document library plugin for WordPress. The vulnerability arises from the FILR_Uploader class not properly restricting file types, allowing authenticated users with Administrator-level privileges or higher to upload HTML files containing malicious JavaScript. These scripts execute when users with permission to create or edit 'filr' post types access the uploaded files, resulting in stored cross-site scripting. The issue impacts all versions up to and including 1.2.11. The CVSS 3.1 vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, scope changed, with low confidentiality and integrity impact and no availability impact.

An attacker with Administrator-level access can exploit this vulnerability to upload malicious HTML files that execute JavaScript in the context of users accessing those files. This can lead to stored cross-site scripting attacks, potentially compromising user sessions or performing unauthorized actions within the WordPress site. The impact is limited to users with permissions to interact with the 'filr' post type and does not affect availability.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Administrator-level access to trusted users only and consider disabling or limiting use of the Filr plugin if possible. Monitor vendor channels for updates and apply official patches promptly once released.