CVE-2026-8378 Details
Description
The Frontend File Manager Plugin WordPress plugin through 23.6 does not sanitise nor escape a filename submitted to the frontend file-rename endpoint before storing it as post meta and rendering it back on the admin File Manager listing, leading to a Stored Cross-Site Scripting vulnerability exploitable by users with Subscriber-level access and above against an administrator viewing the file management interface.
A stored cross-site scripting vulnerability has been identified in the Frontend File Manager WordPress plugin, affecting versions through 23.6. The issue arises because the plugin fails to properly sanitize or escape filenames submitted to the frontend file-rename endpoint. This oversight allows users with Subscriber-level access and above to inject malicious scripts that are stored as post meta and later executed when an administrator views the file management interface.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 23, 2026CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/19f5dd94-b16c-4ad2-9586-d15ddecf9805/ | [email protected] | AdvisoryExploitPartial ContentRemedy |
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
| Product | Versions |
|---|---|
| Frontend File Manager | <= 23.6 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 23, 2026 | New CVE Received | [email protected] |