CVE-2021-4365: Frontend File Manager <= 18.2 - Unauthenticated Stored Cross-Site Scripting
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to, and including, 18.2. This is due to lacking authentication protections and santisation all on the wpfmeditfiletitledesc AJAX action. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-4365?
CVE-2021-4365 refers to a vulnerability in the Frontend File Manager plugin for WordPress that allows unauthenticated stored cross-site scripting.
How severe is CVE-2021-4365?
CVE-2021-4365 has a severity rating of 6.1, which is considered high.
Which versions of the Frontend File Manager plugin for WordPress are affected by CVE-2021-4365?
Versions up to and including 18.2 of the Frontend File Manager plugin for WordPress are affected by CVE-2021-4365.
How does CVE-2021-4365 impact WordPress websites?
CVE-2021-4365 can allow attackers to execute malicious scripts on vulnerable WordPress websites, potentially leading to unauthorized access or other security breaches.
Is there a fix available for CVE-2021-4365?
Yes, the vulnerability in the Frontend File Manager plugin for WordPress has been fixed in versions after 18.2. It is recommended to update to the latest version to mitigate the risk.