CVE-2026-85081 is a Cross-Site Scripting (CWE-79) vulnerability in the File Manager WordPress plugin and related plugins caused by improper origin validation of window messages in the file browser loaded on admin screens. The plugins accept any origin that is a leading string prefix of the site's address, enabling an unauthenticated attacker to execute arbitrary JavaScript in the context of a logged-in administrator's session if they visit a malicious page. This vulnerability affects File Manager versions prior to 8.0.5, FileOrganizer prior to 1.2.1, and File Manager Pro prior to 2.1.3. The root cause is in the shared file-manager library, with all versions below 2.1.70 vulnerable. Remediation involves updating the bundled library to a fixed version.

An unauthenticated attacker can execute arbitrary JavaScript in the session of a logged-in administrator by exploiting this XSS vulnerability. This can lead to session hijacking, unauthorized actions performed with administrator privileges, or other attacks leveraging the administrator's elevated permissions. The attack requires the administrator to visit a page controlled by the attacker.

Update the File Manager plugin to version 8.0.5 or later, FileOrganizer to version 1.2.1 or later, and File Manager Pro to version 2.1.3 or later. These updates include a fixed version of the bundled file-manager library (version 2.1.70 or later) that correctly validates the origin of window messages. Applying these official fixes fully mitigates the vulnerability.