CVE-2026-15009 is a stored cross-site scripting vulnerability (CWE-79) in the Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution plugin. The vulnerability arises from insufficient input sanitization and output escaping of the 'soundFile' parameter, allowing unauthenticated attackers to inject arbitrary web scripts. Successful exploitation depends on the attacker controlling a domain whose origin string is a leading prefix of the target WordPress backend URL and requires the victim to be an authenticated administrator viewing the attacker-controlled page with the File Manager admin screen open.

An attacker can execute arbitrary scripts in the context of the WordPress administrator's browser session, potentially leading to theft of credentials, session hijacking, or other actions performed with administrator privileges. However, exploitation requires specific conditions including domain control and administrator interaction, limiting the attack scope. The CVSS score is 6.1 (medium severity), reflecting the complexity and impact.

No official patch or remediation is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, administrators should avoid visiting untrusted pages while the File Manager admin screen is open and monitor for updates from the plugin vendor.