CVE-2026-8378

Name of the Vulnerable Software and Affected Versions Frontend File Manager Plugin versions prior to 23.7

Description Insufficient sanitization and escaping of filenames submitted to the frontend file-rename endpoint allows a Stored Cross-Site Scripting (XSS) issue. This occurs when the filename is stored as post meta and subsequently rendered in the admin File Manager listing. Users with Subscriber-level access or higher can exploit this to execute malicious scripts in the context of an administrator viewing the file management interface.

Recommendations Update the plugin to a version newer than 23.6.