86 matches found
WordPress Advanced File Manager plugin < 5.4.13 - Authenticated Arbitrary File Read and Write via fma_load_fma_ui vulnerability
Authenticated Arbitrary File Read and Write via fmaloadfmaui vulnerability discovered by Christian Kold Jensen in WordPress Plugin Advanced File Manager versions 5.4.13...
CVE-2026-11565
The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access as low as Subscriber to read arbitrary files on the server — including...
CVE-2026-11565
The Advanced File Manager WordPress plugin (versions prior to 5.4.13 ) contains a vulnerability where it fails to perform proper capability checks in several file management AJAX actions , specifically involving the fma_load_fma_ui function. This flaw allows users with specific roles—even as low ...
EUVD-2026-62256
The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access as low as Subscriber to read arbitrary files on the server — including...
CVE-2026-11565 Advanced File Manager < 5.4.13 - Authenticated Arbitrary File Read and Write via fma_load_fma_ui
The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access as low as Subscriber to read arbitrary files on the server — including...
CVE-2026-11565 Advanced File Manager < 5.4.13 - Authenticated Arbitrary File Read and Write via fma_load_fma_ui
The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access as low as Subscriber to read arbitrary files on the server — including...
CVE-2026-11565: Undefined Security Weakness
The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access as low as Subscriber to read arbitrary files on the server — including...
PT-2026-78270
The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access as low as Subscriber to read arbitrary files on the server — including...
WordPress Advanced File Manager plugin <= 5.4.12 - Reflected Cross-Site Scripting via postMessage 'soundFile' Parameter vulnerability
Reflected Cross-Site Scripting via postMessage 'soundFile' Parameter vulnerability discovered by skyv3il in WordPress Plugin Advanced File Manager versions = 5.4.12...
CVE-2026-15009
The Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'soundFile' parameter in all versions up to, and including, 5.4.12 due to insufficient input sanitization and output escaping. Th...
CVE-2026-15009
CVE-2026-15009 affects the WordPress plugin Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution , with a Stored Cross-Site Scripting (XSS) flaw in the soundFile parameter present in all versions up to and including 5.4.12. The root cause is insufficient input...
CVE-2026-15009
The Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'soundFile' parameter in all versions up to, and including, 5.4.12 due to insufficient input sanitization and output escaping. Th...
EUVD-2026-59865
The Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'soundFile' parameter in all versions up to, and including, 5.4.12 due to insufficient input sanitization and output escaping. Th...
CVE-2026-15009 Advanced File Manager <= 5.4.12 - Reflected Cross-Site Scripting via postMessage 'soundFile' Parameter
The Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'soundFile' parameter in all versions up to, and including, 5.4.12 due to insufficient input sanitization and output escaping. Th...
CVE-2026-15009 Advanced File Manager <= 5.4.12 - Reflected Cross-Site Scripting via postMessage 'soundFile' Parameter
The Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'soundFile' parameter in all versions up to, and including, 5.4.12 due to insufficient input sanitization and output escaping. Th...
PT-2026-73088
The Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'soundFile' parameter in all versions up to, and including, 5.4.12 due to insufficient input sanitization and output escaping. Th...
CVE-2026-15009: Improper Neutralization of Input During Web Page Generation
The Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'soundFile' parameter in all versions up to, and including, 5.4.12 due to insufficient input sanitization and output escaping. Th...
CVE-2026-6382: Undefined Security Weakness
The FileOrganizer WordPress plugin before 1.1.9, Advanced File Manager WordPress plugin before 5.4.12, File Manager Pro WordPress plugin before 2.1.1, File Manager WordPress plugin before 8.0.4 do not properly escape a parameter before passing it to a shell command when processing image operation...