Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-03-24
CVE-2024-0761 - File Manager Plugin
The File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.2.1 due to insufficient randomness in the backup filenames, which use a timestamp plus 4 random digits. This makes it possible for unauthenticated attackers, to extract sensitive data including site backups in configurations where the .htaccess file in the directory does not block access.
PLUGIN
File Manager
CVE-2024-0761
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-6846 - File Manager Plugin
The File Manager Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.3.4 via the mk_check_filemanager_php_syntax AJAX function. This makes it possible for authenticated attackers, with subscriber access and above, to execute code on the server. Version 8.3.5 introduces a capability check that prevents users lower than admin from executing this function.
PLUGIN
File Manager
CVE-2023-6846
Risk Score
Threat Entry
Updated 2025-05-27
CVE-2023-5907 - File Manager Plugin
The File Manager WordPress plugin before 6.3 does not restrict the file managers root directory, allowing an administrator to set a root outside of the WordPress root directory, giving access to system files and directories even in a multisite setup, where site administrators should not be allowed to modify the sites files.
PLUGIN
File Manager
CVE-2023-5907
Risk Score
Threat Entry
Updated 2025-03-24
CVE-2021-24177 - File Manager Plugin
In the default configuration of the File Manager WordPress plugin before 7.1, a Reflected XSS can occur on the endpoint /wp-admin/admin.php?page=wp_file_manager_properties when a payload is submitted on the User-Agent parameter. The payload is then reflected back on the web application response.
PLUGIN
File Manager
CVE-2021-24177
Risk Score