CVE-2024-7559

CVE-2024-7559 – File Manager Pro (WordPress) Arbitrary File Upload . The vulnerability arises from missing file type validation and missing capability checks in the mk_file_folder_manager AJAX action across versions up to and including 8.3.7. An authenticated attacker with Subscriber-level access...

CVE-2023-7015

CVE-2023-7015 concerns the WordPress plugin File Manager Pro. A reflected XSS via the tb parameter exists in all versions up to 8.3.4 due to insufficient input sanitization and output escaping, enabling unauthenticated attackers to inject scripts in pages executed after user actions (e.g., clicki...