Frontend File Manager EUVD-2026-93238

Exploitation targets the N-Media Frontend File Manager plugin (versions ≤ 23.6) on WordPress, which by design exposes file-upload/management functionality to the site frontend - the feature set that introduces the unsanitized input. No authentication is required of the attacker (PR:N), but successful impact depends on a victim (typically a logged-in administrator or moderator) rendering the malicious content (UI:R), so the attacker must deliver a crafted link or get the payload displayed to a privileged user. Limiting factors: the site must have this specific plugin installed and active at an affected version, the frontend upload/display feature must be reachable, and a privileged user must interact with the attacker-supplied content for the scope-changing impact to matter.

This is a moderate-severity reflected/stored Cross-Site Scripting flaw (CWE-79) in the N-Media Frontend File Manager WordPress plugin. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1) indicates a network-reachable, low-complexity, unauthenticated attack that nonetheless requires victim user interaction and yields a changed scope with only Low confidentiality/integrity/availability impact - a profile typical of client-side XSS that escalates by hitting an admin session. Several key prioritization signals are MISSING: no EPSS score was provided, the vulnerability is NOT listed in CISA KEV, and no public proof-of-concept is referenced, so there is no evidence of active or automated exploitation. The only intelligence source is a single Patchstack advisory. Net assessment: this is a real but not urgent issue - the 'unauthenticated' + S:C combination makes it worth patching promptly because an attacker can target site administrators, but the UI:R requirement and absence of EPSS/KEV/POC signals place it well below critical actively-exploited bugs. Treat as a routine-but-prompt patch rather than an emergency.

An unauthenticated attacker crafts a malicious URL or injects a payload through the plugin's frontend file-manager upload/display functionality, then lures a logged-in administrator into viewing it. When the admin's browser renders the unsanitized input, attacker-controlled JavaScript executes in the WordPress admin context (scope change), enabling session/cookie theft or admin actions. No public exploit code is referenced, so exploitation currently requires the attacker to develop the payload themselves.