File Manager Pro Security Vulnerabilities and Issues — File Manager Pro CVE List

Lucene search

Filemanagerpro.ioFile Manager Pro

5 matches found

CVE•added 2023/10/16 9:15 a.m.•65 views

CVE-2023-4827

The File Manager Pro WordPress plugin before 1.8 does not properly check the CSRF nonce in the fs_connector AJAX action. This allows attackers to make highly privileged users perform unwanted file system actions via CSRF attacks by using GET requests, such as uploading a web shell.

8.8CVSS8.5AI score0.21212EPSS

CVE•added 2024/08/23 3:15 a.m.•45 views

CVE-2024-7559

The File Manager Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and capability checks in the mk_file_folder_manager AJAX action in all versions up to, and including, 8.3.7. This makes it possible for authenticated attackers, with Subscriber-leve...

8.8CVSS8.9AI score0.02917EPSS

CVE•added 2024/03/13 4:15 p.m.•44 views

CVE-2023-7015

The File Manager Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tb' parameter in all versions up to, and including, 8.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

6.1CVSS6.4AI score0.00937EPSS

CVE•added 2023/10/16 8:15 p.m.•39 views

CVE-2023-4861

The File Manager Pro WordPress plugin before 1.8.1 allows admin users to upload arbitrary files, even in environments where such a user should not be able to gain full control of the server, such as a multisite installation. This leads to remote code execution.

7.2CVSS7.5AI score0.03529EPSS

CVE•added 2023/10/16 8:15 p.m.•35 views

CVE-2023-4862

The File Manager Pro WordPress plugin before 1.8.1 does not adequately validate and escape some inputs, leading to XSS by high-privilege users.

4.8CVSS4.8AI score0.00077EPSS