Vulnerabilities

TI-2025-30185 CVE-2025-47688 · GHSA-5fq6-9g2x-qxj3

WordPress Advanced File Manager plugin <= 5.3.1 - Broken Access Control to Notice Dismissal vulnerability

MEDIUM 48

Missing Authorization vulnerability in Saad Iqbal Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced File Manager: from n/a thr…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00374 Published 2025-05-07 No fix listed CWE-862

TI-2024-12831 CVE-2024-13805 · GHSA-3336-3gjj-jp53

Advanced File Manager <= 5.2.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload

LOW 28

The Advanced File Manager — Ultimate WordPress File Manager and Document Library Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 5.2.14…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00274 Published 2025-03-07 No fix listed CWE-79

TI-2024-12376 CVE-2024-13333 · GHSA-j5vj-g2rr-m44q

Advanced File Manager 5.2.12 - 5.2.13 - Authenticated (Subscriber+) Arbitrary File Upload

LOW 37

The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fma_local_file_system' function in versions 5.2.12 to 5.2.13.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00921 Published 2025-01-17 No fix listed CWE-434

TI-2024-10555 CVE-2024-11391 · GHSA-jccv-2p4j-xrg6

Advanced File Manager <= 5.2.10 - Authenticated (Subscriber+) Arbitrary File Upload

LOW 36

The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the 'class_fma_connector.php' file in all versions up to, and including, 5.2.10.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00701 Published 2024-12-03 No fix listed CWE-434

TI-2024-08094 CVE-2024-8725 · GHSA-gqqx-m28r-fmjj

Advanced File Manager <= 5.2.8 - Authenticated (Subscriber+) Limited File Upload

LOW 32

Multiple plugins and/or themes for WordPress are vulnerable to Limited File Upload in various versions.

CVSS 3.1MEDIUM 6.8 Network Low privileges No interaction EPSS 0.00378 Published 2024-09-26 No fix listed CWE-434

TI-2024-07533 CVE-2024-8126 · GHSA-8xpj-q2fc-j9j4

Advanced File Manager <= 5.2.8 - Authenticated (Subscriber+) Arbitrary File Upload

MEDIUM 42

The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads via the 'class_fma_connector.php' file in all versions up to, and including, 5.2.8.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00946 Published 2024-09-26 No fix listed CWE-434

TI-2024-08073 CVE-2024-8704 · GHSA-p9fh-v6cv-cj9f

Advanced File Manager <= 5.2.8 - Authenticated (Administrator+) Local JavaScript File Inclusion via fma_locale

LOW 35

The Advanced File Manager plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to, and including, 5.2.8 via the 'fma_locale' parameter.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00879 Published 2024-09-26 No fix listed CWE-22

TI-2023-06458 CVE-2023-7062 · GHSA-fqxh-xw44-6m6r

Advanced File Manager Shortcodes <= 2.4 - Authenticated (Contributor+) Directory Traversal

LOW 39

The Advanced File Manager Shortcodes plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00716 Published 2024-07-10 No fix listed CWE-538

TI-2023-06457 CVE-2023-7061 · GHSA-8p7c-2mvg-g9v9

Advanced File Manager Shortcode <= 2.5.3 - Authenticated (Contributor+) Arbitrary File Upload

MEDIUM 42

The Advanced File Manager Shortcodes plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 2.5.3.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00831 Published 2024-07-10 No fix listed CWE-434

TI-2024-05200 CVE-2024-5598 · GHSA-xg85-3q5w-8wff

Advanced File Manager <= 5.2.4 - Sensitive Information Exposure via Directory Listing

MEDIUM 40

The Advanced File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.4 via the 'fma_local_file_system' function.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00556 Published 2024-06-29 No fix listed CWE-922

TI-2023-03565 CVE-2023-3814 · GHSA-26r5-gf8m-4xfr

Advanced File Manager < 5.1.1 - Admin+ Arbitrary File/Folder Access

MEDIUM 56

The Advanced File Manager WordPress plugin before 5.1.1 does not adequately authorize its usage on multisite installations, allowing site admin users to list and read arbitrary files and folders on the server.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00616 Published 2023-09-04 Fixed in 5.1.1 CWE-863

TI-2023-01945 CVE-2023-2068 · GHSA-6h38-5jv9-8r57

File Manager Advanced Shortcode <= 2.3.2 - Unauthenticated Remote Code Execution through shortcode

HIGH 76

The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disallowed MIME types when using the shortcode.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.3962 Published 2023-06-27 No fix listed

Vulnerabilities

Filters