Vulnerability · Published Oct 21, 2026 · Assigned by WPScan
CVE-2026-79627Advanced File Manager 5.4.13 - 5.4.14 - Authenticated Stored XSS via SVG Sanitiser Content-Sniff Bypass
High 7.1
In plain English
A high-severity cross-site scripting in Advanced File Manager from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).
Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.3%top 81.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Advanced File Manager WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager access by an administrator to store a file containing script that is not stripped and that runs in the browser of anyone who opens it, including an administrator.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Advanced File Manager | 5.4.13 – before 6.0.0 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
References
- https://wpscan.com/vulnerability/e6a56b2e-71dc-41cb-8a57-091b5ff47440/ exploit, vdb-entry, technical-description