7.2
High
CVE-2021-4365 The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in…
Description
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to, and including, 18.2. This is due to lacking authentication protections and santisation all on the wpfm_edit_file_title_desc AJAX action. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Frontend File Manager Plugin 18.3 | earliest → < 18.3 | 18.3 |
Other CVEs of Frontend File Manager Plugin
The 13 CVEs of Frontend File Manager Plugin →
CVE-2026-8095
The Frontend File Manager Plugin plugin for WordPress is vulnerable to Authenticated Arbitrary File Deletion in versions…
8.1
High
CVE-2026-1280
The Frontend File Manager Plugin for WordPress is vulnerable to unauthorized file sharing due to a missing capability…
7.5
High
CVE-2025-13382
The Frontend File Manager Plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up…
4.3
Medium
CVE-2023-7306
The Frontend File Manager Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing…
7.5
High