CVE-2026-79627
Advanced File Manager 5.4.13 - 5.4.14 - Authenticated Stored XSS via SVG Sanitiser Content-Sniff Bypass
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Advanced File Manager WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager access by an administrator to store a file containing script that is not stripped and that runs in the browser of anyone who opens it, including an administrator.
| Vendor | unknown |
| Product | advanced file manager |
| Published | Oct 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown advanced file manager
Be the first to know when new unknown vulnerabilities affecting unknown advanced file manager are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Advanced File Manager
5.4.13 < 6.0.0
References
Credits
Karthik Ramakrishnan WPScan