CVE-2024-8918: high-severity vulnerability in File Manager Pro
File Manager Pro <= 8.3.9 - Unauthenticated Limited JavaScript File Upload
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.4epss 0.3%
The File Manager Pro plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up to, and including, 8.3.9. This is due to a lack of proper checks on allowed file types. This makes it possible for unauthenticated attackers, with permissions granted by an administrator, to upload .css and .js files, which could lead to Stored Cross-Site Scripting.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
File Manager · File Manager ProRelated CVEs — File Manager Pro
In the same product, most dangerous first.
CVE-2023-6846HIGHFile Manager Pro <= 8.3.4 - Authenticated (Subscriber+) Arbitrary File UploadEPSS 15.9%CVE-2023-6825CRITICALFile Manager And File Manager Pro (Multiple Versions) - Directory TraversalEPSS 6.0%CVE-2025-0818MEDIUMMultiple elFinder Plugins <= (Various Versions) - Directory Traversal to Arbitrary File DeletionEPSS 1.0%CVE-2024-7559HIGHFile Manager Pro <= 8.3.7 - Authenticated (Subscriber+) Arbitrary File UploadEPSS 0.9%CVE-2024-8746HIGHFile Manager Pro <= 8.3.9 - Unauthenticated Backup File Download and UploadEPSS 0.6%CVE-2023-7015MEDIUMFile Manager Pro <= 8.3.4 - Reflected Cross-Site ScriptingEPSS 0.5%