← back to popular plugins
wordfence / plugin · wp-file-manager
File Manager
wp-file-manager
total installs
1,000,000
total vulns
3
critical
0
high
1
medium
2
low
0
latest vuln
—
patched
3
unpatched
0
avg time to patch
—
vulnerabilities
(3)
File Manager 7.2.2 - 8.0.4 - Unauthenticated Information Exposure
medium
✓ patched
cve id
CVE-2026-19708 ↗
cvss score
5.3
cwe
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
published
Sep 24, 2026
The File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 7.2.2 through 8.0.4. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.
Multiple elFinder Plugins <= 8.0.4 - Reflected Cross-Site Scripting
medium
✓ patched
cve id
CVE-2026-85081 ↗
cvss score
6.1
cwe
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published
Sep 24, 2026
Multiple elFinder plugins for WordPress are vulnerable to Reflected Cross-Site Scripting in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Multiple Plugins <= Multiple Versions - Authenticated Remote Code Execution
high
✓ patched
cve id
CVE-2026-6382 ↗
cvss score
7.2
cwe
CWE-94: Improper Control of Generation of Code ('Code Injection')
published
Jun 15, 2026
Multiple plugins and/or themes for WordPress are vulnerable to Remote Code Execution in various versions. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server.