CVE-2026-79627: Advanced File Manager 5.4.13 - 5.4.14 - Authenticated Stored XSS via SVG Sanitiser Content-Sniff Bypass

Q: Who can exploit this issue?

An attacker must already have file-manager access in the plugin, granted by an administrator. This is not described as an unauthenticated attack.

Q: Who is at risk when a malicious file is stored?

Anyone who opens the stored file in a browser can have the embedded script run, including administrators. Exposure therefore depends on users opening attacker-controlled files through the plugin.

Q: Which versions are affected?

The issue affects Advanced File Manager versions before 6.0.0. The reported vulnerable versions include 5.4.13 and 5.4.14.

Published Oct 21, 2026

Updated

The Advanced File Manager WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager access by an administrator to store a file containing script that is not stripped and that runs in the browser of anyone who opens it, including an administrator.

Affected Software

1 affected component

ModalWeb Advanced File Manager<6.0.0

Event History

Oct 21, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must already have file-manager access in the plugin, granted by an administrator. This is not described as an unauthenticated attack.

Who is at risk when a malicious file is stored?

Anyone who opens the stored file in a browser can have the embedded script run, including administrators. Exposure therefore depends on users opening attacker-controlled files through the plugin.

Which versions are affected?

The issue affects Advanced File Manager versions before 6.0.0. The reported vulnerable versions include 5.4.13 and 5.4.14.

CVE-2026-79627: Advanced File Manager 5.4.13 - 5.4.14 - Authenticated Stored XSS via SVG Sanitiser Content-Sniff Bypass

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Who is at risk when a malicious file is stored?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Who is at risk when a malicious file is stored?

Which versions are affected?