Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-07-06
CVE-2026-6382 - File Manager Pro Plugin
The FileOrganizer WordPress plugin before 1.1.9, Advanced File Manager WordPress plugin before 5.4.12, File Manager Pro WordPress plugin before 2.1.1, File Manager WordPress plugin before 8.0.4 do not properly escape a parameter before passing it to a shell command when processing image operations, allowing authenticated users to perform OS Command Injection. This requires the server to have the ImageMagick convert CLI available without either the PHP imagick or GD extensions.
PLUGIN
File Manager Pro
CVE-2026-6382
Risk Score
Threat Entry
Updated 2024-10-17
CVE-2024-8507 - File Manager Pro Plugin
The File Manager Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.3.9. This is due to missing or incorrect nonce validation on the 'mk_file_folder_manager' ajax action. This makes it possible for unauthenticated attackers to upload arbitrary files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
File Manager Pro
CVE-2024-8507
Risk Score
Threat Entry
Updated 2024-10-17
CVE-2024-8746 - File Manager Pro Plugin
The File Manager Pro plugin for WordPress is vulnerable to arbitrary backup file downloads and uploads due to missing file type validation via the 'mk_file_folder_manager_shortcode' ajax action in all versions up to, and including, 8.3.9. This makes it possible for unauthenticated attackers, if granted access to the File Manager by an administrator, to download and upload arbitrary backup files on the affected site's server which may make remote code execution possible.
PLUGIN
File Manager Pro
CVE-2024-8746
Risk Score
Threat Entry
Updated 2024-10-17
CVE-2024-8918 - File Manager Pro Plugin
The File Manager Pro plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up to, and including, 8.3.9. This is due to a lack of proper checks on allowed file types. This makes it possible for unauthenticated attackers, with permissions granted by an administrator, to upload .css and .js files, which could lead to Stored Cross-Site Scripting.
PLUGIN
File Manager Pro
CVE-2024-8918
Risk Score
Threat Entry
Updated 2025-03-03
CVE-2024-7559 - File Manager Pro Plugin
The File Manager Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and capability checks in the mk_file_folder_manager AJAX action in all versions up to, and including, 8.3.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
PLUGIN
File Manager Pro
CVE-2024-7559
Risk Score
Threat Entry
Updated 2025-03-05
CVE-2023-7015 - File Manager Pro Plugin
The File Manager Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tb' parameter in all versions up to, and including, 8.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
File Manager Pro
CVE-2023-7015
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-6846 - File Manager Pro Plugin
The File Manager Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.3.4 via the mk_check_filemanager_php_syntax AJAX function. This makes it possible for authenticated attackers, with subscriber access and above, to execute code on the server. Version 8.3.5 introduces a capability check that prevents users lower than admin from executing this function.
PLUGIN
File Manager Pro
CVE-2023-6846
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-4861 - File Manager Pro Plugin
The File Manager Pro WordPress plugin before 1.8.1 allows admin users to upload arbitrary files, even in environments where such a user should not be able to gain full control of the server, such as a multisite installation. This leads to remote code execution.
PLUGIN
File Manager Pro
CVE-2023-4861
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-4862 - File Manager Pro Plugin
The File Manager Pro WordPress plugin before 1.8.1 does not adequately validate and escape some inputs, leading to XSS by high-privilege users.
PLUGIN
File Manager Pro
CVE-2023-4862
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-4827 - File Manager Pro Plugin
The File Manager Pro WordPress plugin before 1.8 does not properly check the CSRF nonce in the `fs_connector` AJAX action. This allows attackers to make highly privileged users perform unwanted file system actions via CSRF attacks by using GET requests, such as uploading a web shell.
PLUGIN
File Manager Pro
CVE-2023-4827
Risk Score