File Manager Pro
Monthly
OS command injection in a family of popular WordPress file-manager plugins - FileOrganizer (before 1.1.9), Advanced File Manager (before 5.4.12), File Manager Pro (before 2.1.1), and File Manager (before 8.0.4) - lets authenticated users inject arbitrary shell commands through an unescaped parameter passed to the ImageMagick convert CLI during image operations. Reported by WPScan, publicly available exploit code exists, though EPSS is modest at 0.52% (40th percentile) and CISA SSVC records exploitation as 'none'. Exploitation is real but gated: the server must fall back to the ImageMagick convert binary because neither the PHP imagick nor GD extension is installed.
The File Manager Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and capability checks in the mk_file_folder_manager AJAX action in all versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The File Manager Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tb' parameter in all versions up to, and including, 8.3.4 due to insufficient input sanitization and. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
OS command injection in a family of popular WordPress file-manager plugins - FileOrganizer (before 1.1.9), Advanced File Manager (before 5.4.12), File Manager Pro (before 2.1.1), and File Manager (before 8.0.4) - lets authenticated users inject arbitrary shell commands through an unescaped parameter passed to the ImageMagick convert CLI during image operations. Reported by WPScan, publicly available exploit code exists, though EPSS is modest at 0.52% (40th percentile) and CISA SSVC records exploitation as 'none'. Exploitation is real but gated: the server must fall back to the ImageMagick convert binary because neither the PHP imagick nor GD extension is installed.
The File Manager Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and capability checks in the mk_file_folder_manager AJAX action in all versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The File Manager Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tb' parameter in all versions up to, and including, 8.3.4 due to insufficient input sanitization and. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.