Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2018-16363 — Cross-site Scripting in File Manager

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
5.4MEDIUMNVD
EPSS
1.8%
top 16.99%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Filemanagerpro File Manager
Timeline
PublishedSep 7
Latest updateMay 14

Description

The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wp_file_manager request because set_transient is used in file_folder_manager.php and there is an echo of lang in lib\wpfilemanager.php.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages1 packages

Patches

Patch: plugins.trac.wordpress.org ↗Patch: wpvulndb.com ↗Patch: plugins.trac.wordpress.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-7gvh-pc64-w2xw: The mndpsingh287 File Manager plugin V2↗2022-05-14
▶
CVEList
CVE-2018-16363: The mndpsingh287 File Manager plugin V2↗2018-09-07
▶

💥Exploits & PoCs

1
Nuclei
WordPress File Manager < 3.0 - Cross-Site Scripting
▶
CVE-2018-16363 — Cross-site Scripting in File Manager | cvebase