CVE-2026-79627

Deferred Deferred - Pending Action

Stored XSS in Advanced File Manager WordPress Plugin

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: WPScan

Description

The Advanced File Manager WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager access by an administrator to store a file containing script that is not stripped and that runs in the browser of anyone who opens it, including an administrator.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-21

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-79627

EUVD

EUVD-2026-107081

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	Advanced File Manager	5.4.13

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is an Authenticated Stored Cross-Site Scripting (XSS) vulnerability in the Advanced File Manager WordPress plugin. It occurs because the plugin does not properly check if a file is an SVG before sanitizing it. This allows users with file-manager access to upload malicious scripts disguised as SVG files. When these files are viewed, the scripts execute in the browsers of anyone who opens them, including administrators.

Detection Guidance

Check if the Advanced File Manager plugin is installed and verify its version. If it is between 5.4.13 and 5.4.14, it is vulnerable. Inspect uploaded files for SVG extensions or unexpected scripts in file content.

Impact Analysis

An attacker with file-manager access could upload a malicious SVG file containing a script. When an administrator or other user views the file, the script runs in their browser, potentially stealing session cookies, performing actions on their behalf, or redirecting them to malicious sites. This could lead to unauthorized access to sensitive data or control of the WordPress site.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. If exploited, it may result in data breaches, leading to legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Update the Advanced File Manager plugin to version 6.0.0 or later immediately. Remove any untrusted SVG files or scripts uploaded by users with file-manager access. Restrict file-manager access to trusted users only.

Hi! I’m here to help you understand CVE-2026-79627. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...