The FileBird WordPress plugin suffers from a stored cross-site scripting vulnerability due to improper neutralization of input during web page generation (CWE-79). Specifically, imported folder titles are not properly sanitized or escaped, enabling authenticated users with administrator privileges to inject malicious scripts. These scripts persist and execute in the context of users viewing the affected pages. The vulnerability impacts all versions up to 5.5.8.1. Exploitation requires administrator-level access, and no known exploits are reported in the wild. The CVSS 3.1 base score is 5.5, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and partial confidentiality and integrity impact.

An attacker with administrator privileges can inject persistent malicious scripts via folder titles imported into the plugin. These scripts execute in the browsers of users who view the affected pages, potentially leading to theft of session tokens, defacement, or other script-based attacks. The impact is limited by the requirement for administrator access and the absence of reported active exploitation. Confidentiality and integrity impacts are partial, with no availability impact noted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and avoid importing folder titles from untrusted sources. Monitor vendor channels for updates or patches addressing this vulnerability.