CVE-2024-2345: medium-severity vulnerability in ninjateam FileBird – WordPress Media Library…
FileBird – WordPress Media Library Folders & File Manager <= 5.6.3 - Authenticated (Author+) Stored Cross-Site Scripting
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.4epss 0.3%
The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the folder name parameter in all versions up to, and including, 5.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Related CVEs — ninjateam FileBird – WordPress Media Library…
In the same product, most dangerous first.
CVE-2025-6986MEDIUMFileBird – WordPress Media Library Folders & File Manager <= 6.4.8 - Authenticated (Author+) SQL InjectionEPSS 0.4%CVE-2024-0691MEDIUMFileBird <= 5.6.0 - Authenticated(Administrator+) Stored Cross-Site Scripting via Folder ImportEPSS 0.4%CVE-2026-15004MEDIUMFileBird – WordPress Media Library Folders & File Manager <= 6.5.6 - Authenticated (Author+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-2346MEDIUMFileBird – WordPress Media Library Folders & File Manager <= 5.6.3 - Authenticated (Author+) Insecure Direct Object ReferenceEPSS 0.3%CVE-2025-11510MEDIUMFileBird <= 6.4.9 - Improper Authorization to Authenticated (Author+) Settings ResetEPSS 0.3%CVE-2025-12900MEDIUMFileBird – WordPress Media Library Folders & File Manager <= 6.5.1 - Missing Authorization to Authenticated (Author+) Global Folders TamperingEPSS 0.2%