7.1
High
CVE-2026-79627 The Advanced File Manager WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG…
Description
The Advanced File Manager WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager access by an administrator to store a file containing script that is not stripped and that runs in the browser of anyone who opens it, including an administrator.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Advanced File Manager 5.4 | 5.4.13 → < 6.0.0 | 6.0.0 |
Other CVEs of Advanced File Manager
The 4 CVEs of Advanced File Manager →
CVE-2026-11565
The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file…
8.5
High
CVE-2026-6382
The FileOrganizer WordPress plugin before 1.1.9, Advanced File Manager WordPress plugin before 5.4.12, File Manager…
9.1
Critical
CVE-2023-3814
The Advanced File Manager WordPress plugin before 5.1.1 does not adequately authorize its usage on multisite…
4.9
Medium