Executive brief
The Frontend File Manager plugin for WordPress, which allows users to upload and manage files from the website's frontend, contains a security flaw. An attacker with a basic user account can rename a file using malicious code that triggers when a site administrator views the file management dashboard. This could allow the attacker to hijack the administrator's session, potentially leading to a full takeover of the website.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Frontend File Manager Plugin through version 23.6. The issue stems from a failure to sanitize or escape filenames submitted to the frontend file-rename endpoint before they are stored as post meta. When an administrator views the File Manager listing in the WordPress backend, the malicious payload is executed in their browser context. This vulnerability is exploitable by users with Subscriber-level access or higher. As of the advisory date, no official patch has been released.
Affected products
- nmedia-user-file-uploader Frontend File Manager Plugin <= 23.6
Timeline
- 2026-06-02: disclosed: Initial public disclosure by WPScan
- 2026-06-23: advisory: CVE published to NVD dataset