Live › vulnerability › CVE-2026-79627
Go to dashboardThe Advanced File Manager WordPress plugin before 6.0.0 fails to recognise some uploaded files as SVG, so its sanitiser does not strip script from them. A user with file-manager access can store a file whose script runs in the browser of anyone who opens it, including an administrator.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Advanced File Manager plugin before 6.0.0 where some users have been granted file-manager access by an administrator. The exposure is strongest where administrators browse the stored files through the plugin. Sites without this plugin, or with it at 6.0.0 or later, can skip it.
No product ranges from the sources yet.
wp plugin get advanced-file-manager --field=version6.0.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Advanced File Manager WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager access by an administrator to store a file containing script that is not stripped and that runs in the browser of anyone who opens it, including an administrator.
This page as .md · .json · in your agent: get_signal("CVE-2026-79627")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.