The Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution plugin is vulnerable to stored cross-site scripting via SVG file uploads due to improper neutralization of input during web page generation (CWE-79). This allows authenticated users with at least Subscriber-level access and appropriate permissions to inject arbitrary web scripts embedded in SVG files. These scripts execute in the context of users viewing the SVG files, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to 5.2.14. No vendor advisory or patch information is currently available.

The vulnerability enables authenticated users with Subscriber-level access or higher and granted permissions to inject malicious scripts via SVG file uploads. These scripts execute when other users access the SVG files, potentially compromising user sessions or performing unauthorized actions within the context of the affected WordPress site. The impact is limited to confidentiality and integrity (low-level data exposure or manipulation) without availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict SVG file upload permissions to trusted users only and consider disabling SVG uploads if possible. Monitor for plugin updates from the vendor and apply them promptly once released.