EUVD-2026-38419
GHSA-v62r-5pwf-6945
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
PR:L confirmed by subscriber-level requirement; UI:R because admin must view listing; S:C reflects cross-context execution in admin session; no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
The Frontend File Manager Plugin WordPress plugin through 23.6 does not sanitise nor escape a filename submitted to the frontend file-rename endpoint before storing it as post meta and rendering it back on the admin File Manager listing, leading to a Stored Cross-Site Scripting vulnerability exploitable by users with Subscriber-level access and above against an administrator viewing the file management interface.
AnalysisAI
Stored Cross-Site Scripting in the Frontend File Manager Plugin for WordPress (versions through 23.6) allows any authenticated subscriber-level user to compromise administrator sessions by injecting malicious script payloads via the frontend file-rename endpoint. The unsanitized filename is persisted as post meta and subsequently rendered unescaped within the WordPress admin File Manager listing, triggering execution whenever an administrator views that interface. A publicly available proof-of-concept exists per WPScan, and no confirmed patched version is identified in available data, making this an unresolved risk for all sites running this plugin at or below version 23.6.
Technical ContextAI
The affected product is a WordPress plugin identified by CPE cpe:2.3:a:unknown:frontend_file_manager_plugin:*:*:*:*:*:*:*:*, exposing a frontend-facing file-rename HTTP endpoint accessible to authenticated low-privilege users. The root cause is a failure to sanitize or escape user-supplied filename input both at storage time (written to WordPress post meta via wp_postmeta) and at render time (output to the admin HTML listing without escaping). Although no CWE is formally assigned in the NVD entry, the vulnerability pattern maps precisely to CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS). The scope change (S:C in the CVSS vector) reflects that the injected payload executes in the admin browser context - a separate security principal from the subscriber who injected it - enabling session hijacking, admin account takeover, or malicious plugin/theme installation within WordPress.
RemediationAI
No vendor-released patch identified at time of analysis - no fixed version appears in available intelligence sources. As an immediate compensating control, administrators should deactivate or uninstall the Frontend File Manager Plugin entirely until a patched release is confirmed; disabling the plugin eliminates the vulnerable rename endpoint and removes all associated attack surface with no functional trade-off beyond the plugin's features. If the plugin cannot be disabled, restrict new subscriber registrations or require approval for all new user accounts to reduce the pool of potential attackers. WordPress administrators should also review post meta entries for existing file records for anomalous script content injected prior to detection. Monitor the WPScan advisory at https://wpscan.com/vulnerability/19f5dd94-b16c-4ad2-9586-d15ddecf9805/ for patch release announcements. Web Application Firewall rules filtering stored XSS patterns in filename parameters may provide partial defense but should not be relied upon as a sole control.
More in Frontend File Manager Plugin
View allThe Frontend File Manager plugin for WordPress is vulnerable to Authenticated Settings Change in versions up to, and inc
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Download in versions up t
Unauthenticated file disclosure in the Frontend File Manager Plugin for WordPress (all versions through 23.6) exposes ev
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated HTML Injection in versions up to, and in
Permanent deletion of arbitrary WordPress posts and pages is possible via the Frontend File Manager Plugin (all versions
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary Post Deletion in versions up t
The Frontend File Manager Plugin WordPress plugin before 22.6 has a vulnerability that allows an Editor+ user to bypass
The Frontend File Manager plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Post Meta Change in versions up to, and
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Content Injection in versions up to, and
Cross-site request forgery in the Frontend File Manager Plugin for WordPress (all versions through 23.6) enables attacke
Share
External POC / Exploit Code
Leaving vuln.today