{"schemaVersion":3,"id":"CVE-2026-85081","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"The File Manager WordPress plugin before 8.0.5, FileOrganizer  WordPress plugin before 1.2.1, File Manager Pro  WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading string prefix of the site's own address, which allows an unauthenticated attacker to run arbitrary JavaScript in the session of a logged-in administrator who visits a page under their control.\n\nThe defect is in the file-manager library all three bundle, and every version below 2.1.70 carries it. Updating the bundled library closes it.","dates":{"published":"2026-09-26T06:00:20.014Z","modified":"2026-09-26T22:41:14.658Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"wordfence","score":6.1,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00216,"percentile":0.11391,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-09-26T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00216,"percentile":0.11391}],"last30":[{"date":"2026-09-26T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00216,"percentile":0.11391}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_0E93763C05E22062","name":"Exploit Reference (wpscan.com)","source":"reference","url":"https://wpscan.com/vulnerability/3c5f9c52-e609-45aa-b441-491e15b3f4b8/","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/79.html"}],"affected":[{"vendor":"unknown","product":"file manager","name":"File Manager","label":"file manager","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 8.0.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.0.5","eol":null,"hubHref":"/vendor/unknown/file_manager"},{"vendor":"unknown","product":"file manager pro","name":"File Manager Pro","label":"file manager pro","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 2.1.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.1.3","eol":null,"hubHref":"/vendor/unknown/file_manager_pro"},{"vendor":"unknown","product":"fileorganizer","name":"FileOrganizer","label":"fileorganizer","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 1.2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.2.1","eol":null,"hubHref":"/vendor/unknown/fileorganizer"},{"vendor":"wordpress","product":"fileorganizer","name":"FileOrganizer – WordPress File Manager","label":"fileorganizer","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 1.2.0 (fixed in 1.2.1)","noFixRecorded":false,"fixedIn":"1.2.1"}],"versionsText":"≤ 1.2.0 (fixed in 1.2.1)","eol":null,"hubHref":null},{"vendor":"wordpress","product":"filester","name":"File Manager Pro – Filester","label":"filester","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 2.1.2 (fixed in 2.1.3)","noFixRecorded":false,"fixedIn":"2.1.3"}],"versionsText":"≤ 2.1.2 (fixed in 2.1.3)","eol":null,"hubHref":null},{"vendor":"wordpress","product":"wp-file-manager","name":"File Manager","label":"wp-file-manager","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 8.0.4 (fixed in 8.0.5)","noFixRecorded":false,"fixedIn":"8.0.5"}],"versionsText":"≤ 8.0.4 (fixed in 8.0.5)","eol":null,"hubHref":null}],"affectedCount":6,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://wpscan.com/vulnerability/3c5f9c52-e609-45aa-b441-491e15b3f4b8/","label":"wpscan.com/vulnerability/3c5f9c52-e609-45aa-b441-491e15b3f4b8/","hostname":"wpscan.com","tags":["Exploit","VDB Entry","Technical Description"]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bcaa6e3-c789-4859-a514-6b86e799c16d","label":"www.wordfence.com/threat-intel/vulnerabilities/id/3bcaa6e3-c789-4859-a514-6b86e799c16d","hostname":"www.wordfence.com","tags":["Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-09-26T06:00:20.014Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-26T22:41:14.658Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":40,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T12:22:01.766Z","stale":false,"partial":false}}