CVE-2026-15004

MediumCVSS 5.4

Published: 18/09/2026(UTC)Updated: 19/09/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

16th percentile - higher than 16% of all known CVEs

Summary

The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions up to and including 6.5.6 due to insufficient input sanitization and output escaping. Authenticated attackers with Author-level access or above can inject arbitrary web scripts that execute when a user accesses an injected page.

Risk Assessment

An attacker could steal user data, hijack sessions, or spread malicious content. This may lead to compromise of user security and site reputation.

Recommendation

Update the FileBird plugin to the latest version with the fix. Additionally, consider using a web application firewall (WAF) and regularly scan the site for XSS.

Other vulnerabilities in FileBird

CVE-2025-12900Medium
The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to missing authorization in all versions up to and including 6.5.1 via the "ConvertController::insertToNewTable" function due to missing validation on a user-controlled key. This allows authenticated attackers with author level access and above to inject global folders and reassign arbitrary media attachments to those folders under certain circumstances.

Original NVD description (English source)

The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions up to, and including, 6.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS