CVE-2026-85081: unknown file manager Cross-site Scripting

Vulnerability summary

CVE-2026-85081 is a high (CVSS 7.5) Cross-site Scripting vulnerability in unknown file manager. EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 11.3% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 1.2.1, 2.1.3 and 8.0.5.

Timeline

1. 26-09-2026
   PublishedVulnerability first disclosed.
2. 26-09-2026
   Last modifiedVulnerability information updated.

Description

The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading string prefix of the site's own address, which allows an unauthenticated attacker to run arbitrary JavaScript in the session of a logged-in administrator who visits a page under their control. The defect is in the file-manager library all three bundle, and every version below 2.1.70 carries it. Updating the bundled library closes it.

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.