Cross-Site Scripting in File Manager and FileOrganizer WordPress Plugins
CVE-2026-85081

Currently unrated

Key Information:

Vendor

WordPress
Status
File Manager
Fileorganizer
File Manager Pro
Vendor
CVE Published:
26 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-85081?

The File Manager and FileOrganizer plugins for WordPress feature a vulnerability that fails to validate the origin of window messages on their admin screens. This oversight permits unauthenticated attackers to execute arbitrary JavaScript within the context of a logged-in administrator's session, potentially compromising sensitive information and site integrity. Users of the affected versions are strongly advised to update to secure releases, as the flaw resides in the underlying file-manager library utilized by all three plugins, with versions below 2.1.70 being at risk.

Affected Version(s)

File Manager 0 < 8.0.5

File Manager Pro 0 < 2.1.3

FileOrganizer 0 < 1.2.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-85081 - Proof of Concept

References

https://wpscan.com/vulnerability/3c5f9c52-e609-45aa-b441-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mutantgun
WPScan
.