CVE-2018-16363

The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wp_file_manager request because set_transient is used in file_folder_manager.php and there is an echo of lang in lib\wpfilemanager.php.

• CWE-79

• http://blog.51cto.com/010bjsoft/2171087Exploit, Third Party Advisory
• https://plugins.trac.wordpress.org/changeset/1936043Patch, Third Party Advisory
• https://wordpress.org/support/topic/security-concern-6/#post-10655739Third Party Advisory
• https://wpvulndb.com/vulnerabilities/9126Patch, Third Party Advisory
• http://blog.51cto.com/010bjsoft/2171087Exploit, Third Party Advisory
• https://plugins.trac.wordpress.org/changeset/1936043Patch, Third Party Advisory
• https://wordpress.org/support/topic/security-concern-6/#post-10655739Third Party Advisory
• https://wpvulndb.com/vulnerabilities/9126Patch, Third Party Advisory

Published

Sep 7, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-16357An issue was discovered in PbootCMS. There is a SQL injectio…9.8
• CVE-2018-16358A cross-site scripting (XSS) vulnerability in inc/core/class…
• CVE-2018-16359Google gVisor before 2018-08-23, within the seccomp sandbox,…
• CVE-2018-1636Stack-based buffer overflow in oninit in IBM Informix Dynami…6.7
• CVE-2018-16361An issue was discovered in BTITeam XBTIT 2.5.4. news.php all…
• CVE-2018-16362An issue was discovered in the Source Integration plugin bef…6.1
• CVE-2018-16364A serialization vulnerability in Zoho ManageEngine Applicati…8.1
• CVE-2018-16365An issue was discovered in idreamsoft iCMS V7.0.10. admincp.…
• CVE-2018-16366An issue was discovered in idreamsoft iCMS V7.0.10. admincp.…
• CVE-2018-16367In OnlineJudge 2.0, the sandbox has an incorrect access cont…
• CVE-2018-16368SplashXPath::strokeAdjust in splash/SplashXPath.cc in Xpdf 4…
• CVE-2018-16369XRef::fetch in XRef.cc in Xpdf 4.00 allows remote attackers …