---
id: "CVE-2026-79627"
kind: "vulnerability"
aliases: ["CVE-2026-79627"]
title: "Advanced File Manager WordPress plugin: stored SVG script runs in admin browsers"
severity: "high"
cvss: 7.1
epss: 0.00205
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wordpress-plugin"]
not_affected_if: ["no-file-manager-users", "plugin-at-6.0.0-or-later"]
published_at: "2026-10-21T06:16:49+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T03:31:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79627", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-79627", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Advanced File Manager WordPress plugin: stored SVG script runs in admin browsers

The Advanced File Manager WordPress plugin before 6.0.0 fails to recognise some uploaded files as SVG, so its sanitiser does not strip script from them. A user with file-manager access can store a file whose script runs in the browser of anyone who opens it, including an administrator.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Advanced File Manager plugin version in the WordPress admin Plugins screen or with `wp plugin get advanced-file-manager --field=version`
- Look for stored SVG files in the plugin's upload directory that contain script elements

## Fix

- Update the Advanced File Manager plugin to `6.0.0` or later
- Until updated, restrict file-manager access to trusted users only

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-79627
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-79627

## From the sources

The Advanced File Manager  WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager access by an administrator to store a file containing script that is not stripped and that runs in the browser of anyone who opens it, including an administrator.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_