Threats tagged 'ghsa-hj83-mg7w-xg78'

CVE-2026-85081 is a high-severity Cross-Site Scripting (XSS) vulnerability affecting multiple WordPress plugins that use the file-manager library. Versions of File Manager before 8.0.5, FileOrganizer before 1.2.1, and File Manager Pro before 2.1.3 do not properly validate the origin of window messages in their admin file browser, allowing an unauthenticated attacker to execute arbitrary JavaScript in the context of a logged-in administrator. The vulnerability exists in all versions of the bundled file-manager library prior to 2.1.70. Updating the bundled library to 2.1.70 or later mitigates the issue.