CVE-2026-8378

MediumCVSS 5.4/10Last modified Jun 23, 2026

Description

The Frontend File Manager Plugin WordPress plugin through 23.6 does not sanitise nor escape a filename submitted to the frontend file-rename endpoint before storing it as post meta and rendering it back on the admin File Manager listing, leading to a Stored Cross-Site Scripting vulnerability exploitable by users with Subscriber-level access and above against an administrator viewing the file management interface.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published
Jun 23, 2026
Last modified
Jun 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-837809.8Use after free in Windows CCFFilter Driver allows an unauthorized attacker to execute code over a network.CVE-2026-837817.8Improper null termination in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.CVE-2026-837829.8Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to execute code over a network.CVE-2026-837837.8Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.CVE-2026-837848.8Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges over a network.CVE-2026-837857.0Use after free in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.CVE-2026-837864.7Generation of error message containing sensitive information in Windows NTFS allows an authorized attacker to disclose information locally.CVE-2026-837875.5Insufficient verification of data authenticity in Windows DHCP Server allows an authorized attacker to bypass a security feature locally.CVE-2026-837884.6Buffer over-read in Windows RNDIS allows an unauthorized attacker to disclose information with a physical attack.CVE-2026-837898.8Heap-based buffer overflow in Windows SMB Client allows an unauthorized attacker to elevate privileges over a network.CVE-2026-83797.5The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly enforce its nonce check on the file download handler, allowCVE-2026-837907.0Use after free in Windows Hello allows an authorized attacker to elevate privileges locally.
CVE-2026-8378: Medium severity, CVSS 5.4 | Vulnix