CVE-2026-8378: Stored XSS in Frontend File Manager Plugin for WordPress (Versions ≤ 23.6)

Technical summary

CVE-2026-8378 is a stored XSS vulnerability in the Frontend File Manager Plugin caused by insufficient input sanitization and output encoding of filenames submitted to the frontend file-rename endpoint. The plugin fails to sanitize user-supplied filename input before storing it as WordPress post metadata and subsequently rendering it in the admin File Manager listing page. The vulnerability requires authentication at the Subscriber level or higher but exploits trust in the admin interface, where the stored malicious payload executes in the context of an authenticated administrator's session.

Business impact

This vulnerability creates a privilege escalation and data integrity risk. Although exploitation requires a valid user account, the bar is low—Subscriber is the default free account tier. A malicious subscriber can compromise administrator accounts without additional credential theft, enabling unauthorized content modification, plugin installation, user account creation, or database access. For multi-author or community-driven WordPress sites, the risk is elevated.

Affected systems

WordPress installations running the Frontend File Manager Plugin through version 23.6 are affected. Any site allowing user registration or account provisioning—particularly those with Subscriber-level users—faces heightened exposure. Sites relying on the plugin for user-facing file upload and rename workflows are most impacted.

Exploitability

Exploitability is straightforward once an attacker obtains any valid user account. The network vector and low attack complexity mean no special tooling is required—a simple web request to the file-rename endpoint with a specially crafted filename triggers the vulnerability. The Subscriber role is often assigned permissively, lowering the barrier to obtaining initial access. User interaction is required (an administrator must visit the File Manager page), but this is a routine administrative task, making reliable exploitation feasible.

Remediation

Upgrade the Frontend File Manager Plugin to a patched version released after June 2026 that addresses input sanitization and output encoding of filenames. Verify the specific version number against the plugin's official repository or vendor advisory. Until patching is possible, restrict the file-rename feature to trusted administrators only or disable the plugin if it is not essential to site operations.

Patch guidance

Check the WordPress Plugin Directory and the plugin vendor's release notes for versions published after June 23, 2026, that explicitly address this XSS vulnerability. Apply patches to all affected plugin instances across your WordPress environment. Test file-rename functionality after patching to ensure no regression. If a patch is not yet available from the vendor, consider disabling the plugin temporarily or implementing capability-based access controls to limit the rename endpoint to administrative users only.

Detection guidance

Monitor WordPress admin logs and post meta modifications for suspicious filename entries containing script tags, event handlers (onclick, onerror), or encoded JavaScript. Review File Manager listing page access logs for patterns consistent with reconnaissance or payload testing. Use WordPress security plugins (such as Wordfence or Sucuri) to detect and log XSS payloads in post metadata. Audit user accounts with Subscriber or higher roles to identify unexpected or inactive users who may pose exploitation risk.

Why prioritize this

Although the CVSS score of 5.4 (Medium) reflects the authentication requirement, context elevates priority: the Subscriber role is widely provisioned, routine admin File Manager visits ensure reliable user interaction for payload execution, and compromise of administrator accounts leads to full site control. Community-driven or multi-tenant sites should treat this as higher priority than the base score suggests.

Risk score, explained

The CVSS 3.1 score of 5.4 reflects a network-accessible vulnerability with low attack complexity but requiring valid authentication (PR:L) and administrator interaction (UI:R). Scope is changed because the attack crosses trust boundaries within the application (admin interface). Impact is limited to confidentiality and integrity; availability is not affected. Organizations with strict Subscriber account policies or small teams may rate this lower; those with open registration or large user bases should consider tactical elevation.

Frequently asked questions