CVE-2018-16363: XSS
First published: Fri Sep 07 2018(Updated: )
The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wp_file_manager request because set_transient is used in file_folder_manager.php and there is an echo of lang in lib\wpfilemanager.php.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Webdesi9 File Manager | =2.9 | |
| Filemanagerpro File Manager Wordpress | =2.9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2018-16363?
CVE-2018-16363 is a vulnerability in the mndpsingh287 File Manager plugin V2.9 for WordPress that allows for XSS attacks.
How does CVE-2018-16363 work?
CVE-2018-16363 works by exploiting the lang parameter in a wp-admin/admin.php?page=wp_file_manager request to execute XSS attacks.
What is the severity of CVE-2018-16363?
The severity of CVE-2018-16363 is medium with a CVSS score of 5.4.
How can I fix CVE-2018-16363?
To fix CVE-2018-16363, update the mndpsingh287 File Manager plugin to version 2.9 or higher.
Where can I find more information about CVE-2018-16363?
You can find more information about CVE-2018-16363 on the following websites: http://blog.51cto.com/010bjsoft/2171087, https://plugins.trac.wordpress.org/changeset/1936043, and https://wordpress.org/support/topic/security-concern-6/#post-10655739.
- collector/nvd-index
- agent/references
- agent/type
- agent/remedy
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/weakness
- agent/author
- agent/description
- agent/first-publish-date
- agent/tags
- agent/event
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/webdesi9
- canonical/webdesi9 file manager
- version/webdesi9 file manager/2.9
- vendor/filemanagerpro
- canonical/filemanagerpro file manager wordpress
- version/filemanagerpro file manager wordpress/2.9