CVE-2026-79627: unknown advanced file manager Cross-site Scripting
CVSS: 7.1v3.1HighReceived
Published 21-10-2026Last modified 21-10-2026
Vulnerability summary
CVE-2026-79627 is a high (CVSS 7.1) Cross-site Scripting vulnerability in unknown advanced file manager. 1 public exploit is recorded.
CVSS score
7.1/10
010
High · v3.1 (CVE.org)EPSS score
Not scored
0%100%
No EPSS score yetKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Timeline
- 21-10-2026PublishedVulnerability first disclosed.
- 21-10-2026Last modifiedVulnerability information updated.
Description
The Advanced File Manager WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager access by an administrator to store a file containing script that is not stripped and that runs in the browser of anyone who opens it, including an administrator.
CVSS metrics
2 scores · 2 sources · 1 versionHigh 7.1Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:HSourcesAll 2 agree
- NVDNIST7.1HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Unknown1 product
- advanced file manager≥ 5.4.13, < 6.0.0
1 vendor · 1 product