CVE-2026-15004: FileBird – WordPress Media Library Folders & File Manager <= 6.5.6 - Authenticated (Author+) Stored Cross-Site Scripting
Published Sep 18, 2026
·Updated
The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions up to, and including, 6.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
1 affected component
WordPress plugin FileBird – Media Library Folders & File Manager<=6.5.6
Event History
Sep 18, 2026
CVE Published
via MITRE·07:40 AM
Data Sourced
via MITRE·07:40 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require a victim to click a link or otherwise interact with attacker-controlled content?
No. The issue is stored XSS with no user interaction requirement; injected scripts execute when a user accesses a page containing the injected content.
2
What level of access does an attacker need to create the malicious content?
An attacker must be authenticated to WordPress with Author-level access or higher. Unauthenticated attackers are not described as able to exploit this issue.