CVE-2021-4365 — Cross-site Scripting in Frontend File Manager Plugin

CWE-79 — Cross-site Scripting3 documents3 sources
Severity
6.1MEDIUMNVD
CNA7.2
EPSS
1.0%
top 22.45%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Nmedia Frontend File Manager PluginNajeebmedia Frontend File Manager Plugin
Timeline
PublishedJun 7

Description

The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to, and including, 18.2. This is due to lacking authentication protections and santisation all on the wpfm_edit_file_title_desc AJAX action. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

Patches

Patch: plugins.trac.wordpress.org ↗Patch: plugins.trac.wordpress.org ↗

🔴Vulnerability Details

2
CVEList
Frontend File Manager <= 18.2 - Unauthenticated Stored Cross-Site Scripting↗2023-06-07
▶
GHSA
GHSA-j7rg-f8wp-8crf: The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to, and including, 18↗2023-06-07
▶
CVE-2021-4365 — Cross-site Scripting | cvebase