Vulnerabilities

TI-2023-04695 CVE-2023-5105 · GHSA-88wc-fvvx-mpxr

Frontend File Manager < 22.6 - Editor+ Arbitrary File Download

LOW 31

The Frontend File Manager Plugin WordPress plugin before 22.6 has a vulnerability that allows an Editor+ user to bypass the file download logic and download files such as `wp-config.php`

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01048 Published 2023-12-04 Fixed in 22.6 CWE-22

TI-2021-03226 CVE-2021-4369 · GHSA-xcp4-vpmq-w2pr

Frontend File Manager <= 18.2 - Unauthenticated Content Injection

LOW 33

The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Content Injection in versions up to, and including, 18.2.

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.00797 Published 2023-06-07 Fixed in 18.3 CWE-862

TI-2021-03225 CVE-2021-4368 · GHSA-254w-gr7h-wvh4

Frontend File Manager <= 18.2 - Authenticated Settings Change leading to Arbitrary File Upload

MEDIUM 47

The Frontend File Manager plugin for WordPress is vulnerable to Authenticated Settings Change in versions up to, and including, 18.2.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.01853 Published 2023-06-07 Fixed in 18.3 CWE-862

TI-2021-03222 CVE-2021-4365 · GHSA-j7rg-f8wp-8crf

Frontend File Manager <= 18.2 - Unauthenticated Stored Cross-Site Scripting

LOW 39

The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to, and including, 18.2.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00758 Published 2023-06-07 Fixed in 18.3 CWE-79

TI-2021-03216 CVE-2021-4359 · GHSA-8mxc-2qjp-x88p

Frontend File Manager Plugin <= 18.2 - Unauthenticated Arbitrary Post Deletion

LOW 36

The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary Post Deletion in versions up to, and including, 18.2.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00877 Published 2023-06-07 Fixed in 18.3 CWE-862

TI-2021-03213 CVE-2021-4356 · GHSA-538r-g5r4-2c2w

Frontend File Manager <= 18.2 - Unauthenticated Arbitrary File Download

MEDIUM 46

The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Download in versions up to, and including, 18.2.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01522 Published 2023-06-07 Fixed in 18.3 CWE-862

TI-2021-03208 CVE-2021-4351 · GHSA-cq9j-298r-ppx5

Frontend File Manager <= 18.2 - Unauthenticated Post Meta Change

LOW 33

The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Post Meta Change in versions up to, and including, 18.2.

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.00678 Published 2023-06-07 Fixed in 18.3 CWE-862

TI-2021-03207 CVE-2021-4350 · GHSA-gc42-wwv9-7qjr

Frontend File Manager <= 18.2 - Unauthenticated HTML Injection leading to Spam Emails

LOW 39

The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated HTML Injection in versions up to, and including, 18.2.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00672 Published 2023-06-07 Fixed in 18.3 CWE-862

TI-2021-03201 CVE-2021-4344 · GHSA-r3qp-rjmv-24xx

Frontend File Manager <= 18.2 - Privilege Escalation

LOW 29

The Frontend File Manager plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 18.2.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00467 Published 2023-06-07 Fixed in 18.3 CWE-285

TI-2022-02885 CVE-2022-3126 · GHSA-g5j9-cp6r-48pp

Frontend File Manager < 21.4 - File Upload via CSRF

MEDIUM 53

The Frontend File Manager Plugin WordPress plugin before 21.4 does not have CSRF check when uploading files, which could allow attackers to make logged in users upload files on their behalf

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00327 Published 2022-10-17 Fixed in 21.4 CWE-352

Vulnerabilities

Filters