CVE-2024-8918 affects the File Manager Pro plugin for WordPress, where improper validation of allowed file types permits limited JavaScript file uploads (.js and .css) by unauthenticated users who have been granted permissions by an administrator. This vulnerability can result in stored cross-site scripting attacks. The issue is tracked as CWE-434 and has a CVSS 3.1 base score of 7.4, indicating a high severity remote vulnerability with high impact on confidentiality and integrity but no impact on availability. No patch or official fix details are currently available.

Successful exploitation allows attackers to upload malicious JavaScript or CSS files, potentially leading to stored cross-site scripting attacks. This can compromise the confidentiality and integrity of the affected WordPress site, enabling attackers to execute arbitrary scripts in the context of users visiting the site. There is no indication of availability impact or known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict permissions to trusted users only and monitor for unauthorized file uploads. Avoid granting upload permissions to unauthenticated or untrusted users. Follow vendor updates closely for any forthcoming patches or official mitigations.