CVE-2026-85081highCWE-79

CVE-2026-85081: high-severity vulnerability in File Manager

Multiple elFinder Plugins - DOM-based XSS via postMessage Origin Bypass

Published

Follow this CVE+ Monitor File Manager+ Monitor File Manager Pro

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

41Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 7.5epss 0.2%
The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading string prefix of the site's own address, which allows an unauthenticated attacker to run arbitrary JavaScript in the session of a logged-in administrator who visits a page under their control. The defect is in the file-manager library all three bundle, and every version below 2.1.70 carries it. Updating the bundled library closes it.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Unknown · File ManagerUnknown · File Manager ProUnknown · FileOrganizer
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — File Manager

In the same product, most dangerous first.

CVE-2023-4827HIGHFile Manager Pro < 1.8 - Remote Code Execution via CSRFEPSS 7.9%CVE-2026-17540HIGHBit File Manager < 6.9.1 - Subscriber+ Arbitrary File Read and Deletion via Connector Command Request-Source MismatchEPSS 1.8%CVE-2023-4861HIGHFile Manager Pro < 1.8.1 - Admin+ Remote Code ExecutionEPSS 1.7%CVE-2026-6382CRITICALMultiple elFinder Plugins - Authenticated OS Command InjectionEPSS 1.4%CVE-2021-24177—WP File Manager < 7.1 - Reflected Cross-Site Scripting (XSS)EPSS 0.9%CVE-2023-5907MEDIUMFile Manager < 6.3 - Admin+ Arbitrary OS File/Folder Access + Path TraversalEPSS 0.9%