Filebird Wordpress Media Library Folders File Manager
Monthly
Stored cross-site scripting in the FileBird WordPress media library and file manager plugin (all versions up to and including 6.5.6) allows authenticated users with Author-level capabilities or higher to inject arbitrary JavaScript through an image's alt-text field, which is then rendered without adequate escaping in FileBird gallery and PhotoSwipe output. The payload persists in attachment metadata and executes in the browser of any user who later views an affected gallery page, including administrators, so a low-privileged content author can pivot into an administrative session context. The vendor score is moderate (5.4) and our assessment raises the scope to changed (S:C); no public exploit code has been identified at time of analysis and no EPSS or KEV signal was provided, so this should be handled as a routine patch-in-cycle item rather than an emergency.
Stored cross-site scripting in the FileBird WordPress media library and file manager plugin (all versions up to and including 6.5.6) allows authenticated users with Author-level capabilities or higher to inject arbitrary JavaScript through an image's alt-text field, which is then rendered without adequate escaping in FileBird gallery and PhotoSwipe output. The payload persists in attachment metadata and executes in the browser of any user who later views an affected gallery page, including administrators, so a low-privileged content author can pivot into an administrative session context. The vendor score is moderate (5.4) and our assessment raises the scope to changed (S:C); no public exploit code has been identified at time of analysis and no EPSS or KEV signal was provided, so this should be handled as a routine patch-in-cycle item rather than an emergency.