Now officially on WordPress.org

CVE Database / CVE-2024-13805

CVE · Medium

CVE-2024-13805 — Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution [file-manager-advanced] < 5.3.0

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2024-13805 Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution [file-manager-advanced] < 5.3.0 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Medium 6.4 < 5.3.0 5.3.0 2025-03-06 —

CVE-2024-13805

The Advanced File Manager plugin for WordPress contains a stored cross-site scripting vulnerability affecting versions up to 5.2.14 that stems from inadequate sanitization of SVG file uploads and improper output escaping. Authenticated users with Subscriber-level permissions or higher, if granted the necessary capabilities by an administrator, can inject malicious scripts into SVG files that will execute in the browsers of anyone accessing those files. The vulnerability was resolved in version 5.3.0.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings