CVE-2018-16967

The File Manager plugin versions before 3.1 contains multiple security flaws including insufficient protection against cross-site request forgery attacks and inadequate input sanitization. An attacker could exploit these weaknesses to conduct CSRF attacks targeting administrators and inject malicious scripts into the public_path configuration setting.

Based on public CVE data (MITRE/NVD).