CVE-2026-15009

The Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'soundFile' parameter in all versions up to, and including, 5.4.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the attacker to control a domain whose origin string is a leading prefix of the target site's backend URL (e.g. https://example.co against https://example.com), and the victim must be an authenticated WordPress administrator who visits the attacker-controlled page while the File Manager admin screen is open.

• CWE-79

• https://plugins.trac.wordpress.org/browser/file-manager-advanced/tags/5.4.11/application/library/js/elFinder.js#L4596
• https://plugins.trac.wordpress.org/browser/file-manager-advanced/tags/5.4.11/application/library/js/elFinder.js#L4839
• https://plugins.trac.wordpress.org/browser/file-manager-advanced/tags/5.4.11/application/library/js/elFinder.js#L4856
• https://plugins.trac.wordpress.org/browser/file-manager-advanced/tags/5.4.12/application/library/js/elFinder.js#L4596
• https://plugins.trac.wordpress.org/browser/file-manager-advanced/tags/5.4.12/application/library/js/elFinder.js#L4839
• https://plugins.trac.wordpress.org/browser/file-manager-advanced/tags/5.4.12/application/library/js/elFinder.js#L4856
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3645011%40file-manager-advanced&new=3645011%40file-manager-advanced
• https://www.wordfence.com/threat-intel/vulnerabilities/id/9d164f5e-c313-4e45-a17b-61460b10204e?source=cve

Published

Aug 16, 2026

Last Modified

Aug 20, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-15003A flaw was found in the GNU Binutils (Binary Utilities) link…5.6
• CVE-2026-15004The FileBird – WordPress Media Library Folders & File Manage…5.4
• CVE-2026-15005The Loco Translate plugin for WordPress is vulnerable to Cro…8.8
• CVE-2026-15006The Bit integrations – Form Integration, Webhook, Spreadshee…7.5
• CVE-2026-15007A denial of service vulnerability was identified in GitHub E…5.7
• CVE-2026-15008The Uncanny Automator – Easy Automation, Integration, Webhoo…8.1
• CVE-2026-15010The bbp Style Pack plugin for WordPress is vulnerable to Sto…6.4
• CVE-2026-15011The Customer Support Ticket System & Helpdesk plugin for Wor…9.8
• CVE-2026-15012The Demi – One Click Demo Import, WP Backup & Site Migration…5.3
• CVE-2026-15013The SAML Single Sign On – SSO Login plugin for WordPress is …9.8
• CVE-2026-15014The SMS Alert – SMS & OTP for WooCommerce, Order Notificatio…9.8
• CVE-2026-15015The MountDev AI MCP Connector for WordPress plugin for WordP…9.8