CVE-2026-8378 Overview
CVE-2026-8378 is a Stored Cross-Site Scripting (XSS) vulnerability in the Frontend File Manager Plugin for WordPress, affecting all versions up to and including 23.6. The plugin fails to sanitize or escape filenames submitted to the frontend file-rename endpoint. Attacker-controlled filename input is stored as post meta and later rendered in the admin File Manager listing. Authenticated users with Subscriber-level access or higher can inject malicious JavaScript that executes in an administrator's browser session.
Critical Impact
A low-privileged authenticated attacker can store malicious scripts that execute when an administrator views the File Manager interface, enabling session hijacking, privileged action abuse, and account takeover.
Affected Products
- Frontend File Manager Plugin for WordPress, versions up to and including 23.6
Discovery Timeline
- 2026-06-23 - CVE-2026-8378 published to NVD
- 2026-06-23 - Last updated in NVD database
Technical Details for CVE-2026-8378
Vulnerability Analysis
The vulnerability resides in the frontend file-rename endpoint exposed by the plugin. When a user renames a file, the plugin accepts the new filename from the request without applying sanitization or output encoding. The supplied value is persisted as WordPress post meta tied to the uploaded file entry.
When an administrator later opens the backend File Manager listing, the stored filename is rendered into HTML without escaping. A payload such as an HTML tag containing inline JavaScript executes in the administrator's browser under the WordPress admin origin. Because the script runs in an authenticated administrator context, it can perform any action available to that user, including creating new admin accounts, altering plugin configuration, or exfiltrating nonces.
The scope-changed nature of the issue reflects that exploitation by a low-privilege account impacts a higher-privilege victim. The vulnerability is a classic stored XSS pattern [CWE-79], chained with the persistence afforded by WordPress post meta storage.
Root Cause
The root cause is missing input sanitization on the filename parameter at the rename endpoint and missing output escaping when the value is rendered in the admin listing. Neither sanitize_file_name(), wp_kses(), nor esc_html() is applied at the relevant code paths, allowing raw HTML and script content to round-trip from storage to the DOM.
Attack Vector
Exploitation requires an authenticated account with Subscriber-level access, which WordPress sites with open registration grant freely. The attacker uploads a file through the frontend file manager, invokes the rename endpoint, and submits a filename containing an XSS payload. The malicious filename remains dormant until an administrator opens the File Manager interface, at which point the script executes. User interaction from the administrator is required to trigger execution.
No verified public proof-of-concept code is available. See the WPScan Vulnerability Report for additional technical context.
Detection Methods for CVE-2026-8378
Indicators of Compromise
- Post meta entries associated with the Frontend File Manager Plugin containing HTML tags, <script> blocks, or event-handler attributes such as onerror= or onload= within stored filenames.
- Unexpected administrator account creation, role changes, or plugin installations following access to the File Manager admin page.
- HTTP POST requests to the plugin's file-rename endpoint originating from Subscriber-level accounts.
Detection Strategies
- Audit the wp_postmeta table for filename values containing angle brackets, JavaScript URI schemes, or HTML event handlers.
- Review WordPress access logs for rename endpoint invocations correlated with low-privilege user IDs.
- Inspect browser DevTools network and console output when administrators load the File Manager listing for unexpected script execution.
Monitoring Recommendations
- Enable WordPress audit logging to capture file uploads, renames, and user role changes performed through the plugin.
- Alert on creation of new administrator accounts or modification of existing administrator email addresses.
- Monitor for outbound requests from admin browser sessions to unrecognized domains immediately after File Manager access.
How to Mitigate CVE-2026-8378
Immediate Actions Required
- Deactivate the Frontend File Manager Plugin until a patched release is installed if administrators routinely access the File Manager listing.
- Restrict new user registration or disable the Subscriber role's ability to access frontend file management features.
- Review existing stored filenames in post meta and remove or sanitize entries containing HTML or script content.
Patch Information
No fixed version is identified in the available advisory data. Monitor the WPScan Vulnerability Report and the plugin's WordPress.org page for an updated release beyond version 23.6.
Workarounds
- Place the WordPress admin interface behind a web application firewall rule that blocks responses containing <script> tags within plugin-rendered filename fields.
- Apply a Content Security Policy header on the WordPress admin area to prohibit inline script execution, reducing the impact of stored payloads.
- Limit frontend file manager access to trusted, authenticated roles using role-management plugins until a vendor patch is released.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
