Read the docs
TI-2026-58443 Aliases CVE-2026-85081GHSA-hj83-mg7w-xg78

Multiple elFinder Plugins - DOM-based XSS via postMessage Origin Bypass

Priority LOW 34CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.

Summary

The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading string prefix of the site's own address, which allows an unauthenticated attacker to run arbitrary JavaScript in the session of a logged-in administrator who visits a page under their control. The defect is in the file-manager library all three bundle, and every version below 2.1.70 carries it. Updating the bundled library closes it.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00216 12th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed File Manager (Unknown): 8.0.5FileOrganizer (Unknown): 1.2.1+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownFile Managerbefore 8.0.58.0.5Patch availableCNA
UnknownFileOrganizerbefore 1.2.11.2.1Patch availableCNA
UnknownFile Manager Probefore 2.1.32.1.3Patch availableCNA
  • File Manager VendorUnknown Affected before 8.0.5 Fixed in 8.0.5 Patch available CNA
  • FileOrganizer VendorUnknown Affected before 1.2.1 Fixed in 1.2.1 Patch available CNA
  • File Manager Pro VendorUnknown Affected before 2.1.3 Fixed in 2.1.3 Patch available CNA

Remediation

  • Fix · CNA File Manager (Unknown) Fixed in 8.0.5
  • Fix · CNA FileOrganizer (Unknown) Fixed in 1.2.1
  • Fix · CNA File Manager Pro (Unknown) Fixed in 2.1.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    File Manager 8.0.5

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-15987 File Manager 7.2.2 - 8.0.4 - Unauthenticated Database Backup DisclosurePriority LOW 26
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-85081
  2. 2026-10-03 Alias added: GHSA-hj83-mg7w-xg78

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences