CVE-2026-8378 is a stored XSS vulnerability in the Frontend File Manager Plugin for WordPress through version 23.6. The vulnerability arises from improper sanitization and escaping of filenames submitted via the frontend file-rename endpoint. These filenames are stored as post meta and rendered in the admin File Manager listing without adequate encoding, allowing users with Subscriber-level access or above to inject malicious scripts that execute in the context of an administrator's browser session.

An attacker with Subscriber-level access or higher can inject malicious scripts that execute when an administrator views the file management interface. This can lead to session hijacking, privilege escalation, or other malicious actions performed with administrator privileges. The vulnerability affects the confidentiality and integrity of the WordPress administration environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Subscriber-level access and above to trusted users only. Monitor official Frontend File Manager Plugin channels for updates and apply any released patches promptly.