CVE-2026-15004 Overview
CVE-2026-15004 is a Stored Cross-Site Scripting (XSS) vulnerability in the FileBird – WordPress Media Library Folders & File Manager plugin for WordPress. The flaw affects all versions up to and including 6.5.6. It stems from insufficient input sanitization and output escaping of image alt text rendered by the plugin's gallery block. Authenticated users with Author-level access or higher can inject arbitrary JavaScript that executes when visitors view an affected page. The vulnerability is tracked as CWE-79.
Critical Impact
Authenticated contributors and authors can persist malicious scripts in FileBird galleries, enabling session theft, administrative account takeover, and site defacement against any visitor who loads the page.
Affected Products
- FileBird – WordPress Media Library Folders & File Manager plugin
- All versions up to and including 6.5.6
- WordPress sites allowing Author-level (or higher) user registrations
Discovery Timeline
- 2026-09-18 - CVE-2026-15004 published to the National Vulnerability Database
- 2026-09-19 - Last updated in NVD database
Technical Details for CVE-2026-15004
Vulnerability Analysis
The FileBird plugin renders image galleries through the filebird-gallery block. Image alt text supplied by authenticated content contributors flows into the rendered HTML output without adequate sanitization or contextual output escaping. When a visitor loads a page containing the gallery, the injected payload executes in the visitor's browser under the site's origin.
Because the payload is stored in the WordPress database and served on every page view, exploitation requires only one successful injection. Any subsequent visit — including by administrators previewing content — triggers execution. The vendor addressed the issue in a FileBird changeset that tightened sanitization in the affected render paths.
Root Cause
The root cause is missing escaping on the image alt attribute when the gallery block renders its markup. Relevant code paths appear in the gallery render logic and the Photoswipe integration script. Alt text controlled by low-privilege users is concatenated into HTML attributes and JavaScript strings without the WordPress escaping helpers esc_attr() or esc_js() being applied consistently.
Attack Vector
An attacker with Author-level access uploads or edits a media item and supplies malicious content in the image alt text field. The attacker inserts a FileBird gallery block that references the media on a post or page. When any user — authenticated or anonymous — loads the page, the browser parses the unescaped alt text and executes the injected script. The attacker can steal session cookies, perform administrative actions via CSRF, or pivot to full site compromise by targeting logged-in administrators.
No verified public exploit code is available. The vulnerability mechanism is documented in the Wordfence vulnerability analysis.
Detection Methods for CVE-2026-15004
Indicators of Compromise
- Media library entries whose _wp_attachment_image_alt post meta contains <script>, on*= event handlers, or javascript: URIs
- Unexpected outbound requests from visitor browsers to attacker-controlled domains originating from pages containing FileBird galleries
- New administrator accounts or role changes shortly after Author-level users edit media metadata
- Modifications to WordPress options or theme files initiated from administrator sessions loading gallery pages
Detection Strategies
- Query the wp_postmeta table for meta_key = '_wp_attachment_image_alt' values containing HTML or JavaScript syntax
- Deploy a Web Application Firewall rule that inspects rendered responses on pages containing the wp-block-filebird-gallery class for unescaped script tags
- Enable WordPress activity logging for media edits performed by Author-level accounts
- Review Content Security Policy violation reports for inline script executions on gallery pages
Monitoring Recommendations
- Audit all Author, Contributor, and Editor accounts for legitimacy and enforce least privilege
- Monitor plugin version inventories across managed WordPress sites and alert when FileBird versions at or below 6.5.6 are detected
- Alert on unusual admin-ajax.php or REST API activity following media metadata changes
How to Mitigate CVE-2026-15004
Immediate Actions Required
- Update FileBird to a version newer than 6.5.6 that includes the vendor's sanitization fix
- Audit existing image alt text across the media library for injected HTML or JavaScript payloads
- Review recently created Author-level and higher accounts and disable any that are unrecognized
- Rotate credentials and session tokens for administrators who may have loaded pages containing untrusted gallery content
Patch Information
The vendor addressed the flaw in the FileBird source tree. Review the WordPress FileBird changeset for the exact code changes and upgrade to the patched release published on WordPress.org. Reference the Wordfence advisory for fixed-version details.
Workarounds
- Restrict content contribution to trusted users only and remove Author or higher roles from untrusted accounts until patching is complete
- Deploy a strict Content Security Policy that disallows inline scripts on public-facing pages
- Temporarily disable the FileBird gallery block on production sites where updating is not immediately feasible
- Use a WAF ruleset that filters script tags and event handlers from POST requests targeting the media library REST endpoints
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
