FileBird CVE-2026-15004

Requires an authenticated WordPress account with Author-level capabilities or higher (PR:L) on a site running FileBird 6.5.6 or earlier - this is the primary limiting factor, since Author is a trusted role and sites that do not delegate content authoring to lower-trust users face minimal exposure. The attacker must be able to set/edit an image's alt-text field and have that image surfaced via a FileBird gallery/render path (per the referenced render.php and photoswipe gallery code). Execution is delayed and dependent on a second user (ideally an administrator) subsequently viewing the injected page (stored/persistent XSS); no user interaction is required from the attacker at injection time (UI:N), but victim page-view is inherent to the stored XSS delivery. No non-default configuration is required beyond having the plugin active and rendering the affected image.

This is a moderate-severity stored XSS (vendor CVSS 5.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) that should be treated as a routine, patch-in-cycle issue rather than an emergency. The signals are internally consistent but all point to limited real-world urgency: the vector requires PR:L (an authenticated Author-level-or-above account), which is a meaningful barrier since Author is a trusted editorial role not granted to the public on most sites. No EPSS score is provided, no CISA KEV listing exists, and no public POC is referenced - only the Wordfence advisory and the fix changeset. Per the exploitation-status precision rule, this is 'no public exploit identified at time of analysis.' The impact is C:L/I:L/A:N, consistent with script execution in a victim's authenticated browser session (session/cookie theft, limited admin-context actions) rather than full compromise. One notable discrepancy: the vendor scored Scope Unchanged (S:U), yet stored XSS that executes 'whenever a user accesses an injected page' typically crosses a security boundary into another user's/admin's browser context, which many analysts score S:C - this is a defensible disagreement that would raise the score if adopted, but I have retained the impacts as scored. Net: a real but low-priority vulnerability whose exploitation is gated behind trusted authenticated access.

An attacker who holds (or has phished/registered into) an Author-level or higher WordPress account uploads or edits a media item and injects a malicious script payload into the image alt-text field, which FileBird stores without adequate sanitization and renders without output escaping. When an administrator or other user later views a page or gallery embedding that image, the script executes in their authenticated browser session, enabling cookie/session theft or actions in the admin context. No public exploit code is referenced, and success requires the attacker to already possess Author-level credentials.