CVE-2026-15009
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
The Advanced File Manager plugin for WordPress up to version 5.4.12 is vulnerable to Stored Cross-Site Scripting via the 'soundFile' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation requires control of a domain with a prefix matching the backend URL and an authenticated admin visiting the page with the File Manager open.
Risk Assessment
The risk includes admin session hijacking, data theft, and full compromise of the WordPress installation. However, the attack requires specific conditions, limiting its prevalence.
Recommendation
Immediately update the plugin to the latest patched version. Additionally, restrict access to the admin panel and apply the principle of least privilege.
Original NVD description (English source)
The Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'soundFile' parameter in all versions up to, and including, 5.4.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the attacker to control a domain whose origin string is a leading prefix of the target site's backend URL (e.g. https://example.co against https://example.com), and the victim must be an authenticated WordPress administrator who visits the attacker-controlled page while the File Manager admin screen is open.