Stored Cross-Site Scripting in Frontend File Manager Plugin for WordPress
CVE-2026-8378
Currently unrated
What is CVE-2026-8378?
The Frontend File Manager Plugin for WordPress prior to version 23.6 has a security flaw that fails to properly sanitize and escape filenames submitted via the frontend file-rename endpoint. This oversight allows for the potential injection of malicious scripts. As a result, a user with Subscriber-level access or higher could exploit this vulnerability against an administrator viewing the file management interface, leading to possible unauthorized execution of scripts within the application.
Affected Version(s)
Frontend File Manager Plugin 0 <= 23.6
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.