CVE-2026-15009 is a stored cross-site scripting vulnerability in the Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution plugin. The flaw exists due to insufficient input sanitization and output escaping of the 'soundFile' parameter in all versions up to and including 5.4.12. An unauthenticated attacker who controls a domain with an origin string that is a leading prefix of the target WordPress backend URL can inject arbitrary web scripts. These scripts execute when an authenticated WordPress administrator visits the attacker-controlled page while the File Manager admin interface is open, potentially leading to session hijacking or other script-based attacks.

The vulnerability allows an unauthenticated attacker to perform stored cross-site scripting attacks that execute in the context of an authenticated WordPress administrator's browser session. This can lead to the theft of sensitive information, such as authentication tokens or cookies, and potentially allow the attacker to perform actions with the administrator's privileges. However, exploitation requires specific conditions including domain control and administrator interaction, limiting the attack scope.

No official patch or remediation has been confirmed as of the provided data. Users should monitor the vendor's advisory for updates and apply any official fixes once available. Until then, restrict access to the WordPress admin interface, avoid visiting untrusted URLs while logged in as an administrator, and consider disabling or removing the plugin if feasible to reduce exposure.