Vulnerabilities

TI-2024-11438 CVE-2024-12331 · GHSA-449m-fffr-gjmh

File Manager Pro – Filester <= 1.8.6 - Missing Authorization to Authenticated (Subscriber+) Filebird Plugin Installation

LOW 20

The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_install_plugin' function in all versions up to, and including, 1.8.6.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00349 Published 2024-12-19 No fix listed CWE-862

TI-2024-08971 CVE-2024-9669 · GHSA-2vcg-x9q7-3f22

File Manager Pro – Filester <= 1.8.5 - Authenticated (Administrator+) Local JavaScript File Inclusion

LOW 36

The File Manager Pro – Filester plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to, and including, 1.8.5 via the 'fm_locale' parameter.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00976 Published 2024-11-28 No fix listed CWE-22

TI-2024-07478 CVE-2024-8066 · GHSA-rgw5-2p37-xfw9

File Manager Pro – Filester <= 1.8.6- Authenticated (Subscriber+) Arbitrary File Upload

MEDIUM 42

The File Manager Pro – Filester plugin for WordPress is vulnerable to arbitrary file uploads due to missing validation in the 'fsConnector' function in all versions up to, and including, 1.8.6.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01146 Published 2024-11-28 No fix listed CWE-434

TI-2024-06525 CVE-2024-7031 · GHSA-fc63-998f-r568

File Manager Pro – Filester <= 1.8.2 - Authenticated Plugin Settings Update

MEDIUM 41

The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'njt_fs_saveSettingRestrictions' function in all versions up to, and includ…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00619 Published 2024-08-03 No fix listed CWE-862

TI-2023-04475 CVE-2023-4861 · GHSA-qmv3-76vc-754w

File Manager Pro < 1.8.1 - Admin+ Remote Code Execution

HIGH 67

The File Manager Pro WordPress plugin before 1.8.1 allows admin users to upload arbitrary files, even in environments where such a user should not be able to gain full control of the server, such as a multisite installat…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01681 Published 2023-10-16 Fixed in 1.8.1

TI-2023-04476 CVE-2023-4862 · GHSA-x7gg-f2xv-xw56

File Manager Pro < 1.8.1 - Admin+ Stored Cross-Site Scripting

LOW 22

The File Manager Pro WordPress plugin before 1.8.1 does not adequately validate and escape some inputs, leading to XSS by high-privilege users.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.0047 Published 2023-10-16 Fixed in 1.8.1

TI-2023-04443 CVE-2023-4827 · GHSA-3743-q7xh-2hv2

File Manager Pro < 1.8 - Remote Code Execution via CSRF

HIGH 73

The File Manager Pro WordPress plugin before 1.8 does not properly check the CSRF nonce in the `fs_connector` AJAX action.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.07858 Published 2023-10-16 Fixed in 1.8