Read the docs
TI-2026-78564 Aliases CVE-2026-79627GHSA-3846-mpmc-4v59

Stored XSS in Advanced File Manager WordPress plugin via SVG

Priority LOW 33CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
High
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.

Summary

The Advanced File Manager WordPress plugin from 5.4.13 before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it. A user granted file-manager access by an administrator can store a file containing script that is not stripped, and that script runs in the browser of anyone who opens it, including an administrator. This is cross-site scripting (CWE-79) and requires low privileges and user interaction.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The Advanced File Manager WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager access by an administrator to store a file containing script that is not stripped and that runs in the browser of anyone who opens it, including an administrator.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00266 18th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Advanced File Manager (Unknown): 6.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownAdvanced File Manager5.4.13 to before 6.0.06.0.0Patch availableCNA
  • Advanced File Manager VendorUnknown Affected 5.4.13 to before 6.0.0 Fixed in 6.0.0 Patch available CNA

Remediation

Update Advanced File Manager to version 6.0.0, which fixes this issue. The record does not list a vendor advisory.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Advanced File Manager (Unknown) Fixed in 6.0.0

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-79627
  2. 2026-10-21 Alias added: GHSA-3846-mpmc-4v59

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences