CVE-2026-10093 is a stored cross-site scripting vulnerability (CWE-79) in the deepakkite Secure Client Portal and Private File Sharing Plugin – User Private Files for WordPress. The issue exists in the 'fldr_ttl' parameter, which lacks proper input sanitization and output escaping, enabling authenticated attackers with subscriber-level privileges or above to inject arbitrary web scripts. These scripts execute in the context of users who access the injected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all plugin versions up to and including 2.1.6. No official patch or remediation guidance is currently available from the vendor.

An attacker with subscriber-level access or higher can exploit this vulnerability to inject malicious scripts that execute in the browsers of users who visit the compromised pages. This can lead to information disclosure, session hijacking, or other client-side impacts. The vulnerability does not affect availability and requires authentication, but it compromises confidentiality and integrity of user sessions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level user permissions where possible and monitor for suspicious activity related to the 'fldr_ttl' parameter. Consider applying manual input validation or output escaping if feasible as a temporary mitigation.