Not rated
CVE-2021-24177 In the default configuration of the File Manager WordPress plugin before 7.1, a Reflected XSS can occur on the…
Description
In the default configuration of the File Manager WordPress plugin before 7.1, a Reflected XSS can occur on the endpoint /wp-admin/admin.php?page=wp_file_manager_properties when a payload is submitted on the User-Agent parameter. The payload is then reflected back on the web application response.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| File Manager 7.1 | earliest → < 7.1 | 7.1 |
Other CVEs of File Manager
The 8 CVEs of File Manager →
CVE-2026-85081
The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro …
7.5
High
CVE-2026-19708
The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database…
5.9
Medium
CVE-2026-17542
The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager…
7.5
High
CVE-2026-17541
The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes,…
7.5
High