Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-85081: File manager plugins let attacker run code in admin session

CVE-2026-85081 · published 1 month ago

Summary

Several WordPress file manager plugins (File Manager, File Organizer, File Manager Pro) fail to check where messages come from, so a malicious web page can send commands that run script code in a logged‑in administrator’s browser. This could let an attacker steal data or change settings while the admin is logged in. Update the plugins to the latest versions that include the corrected file‑manager library to close the risk.

What to do

Update unknown file manager to version 8.0.5 or later.
Update unknown fileorganizer to version 1.2.1 or later.
Update unknown file manager pro to version 2.1.3 or later.

Affected software

Vendor	Product	Affected versions
unknown	file manager	< 8.0.5
unknown	fileorganizer	< 1.2.1
unknown	file manager pro	< 2.1.3

Original advisory text

Multiple elFinder Plugins - DOM-based XSS via postMessage Origin Bypass

The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading string prefix of the site's own address, which allows an unauthenticated attacker to run arbitrary JavaScript in the session of a logged-in administrator who visits a page under their control.

The defect is in the file-manager library all three bundle, and every version below 2.1.70 carries it. Updating the bundled library closes it.

References

https://wpscan.com/vulnerability/3c5f9c52-e609-45aa-b441-491e15b3f4b8/

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

7.5 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published26 Sep 2026

Updated29 Oct 2026

First seen26 Sep 2026

Sources

CVE-2026-85081 · NVD

CVE-2026-85081 · MITRE

Track software like this

Free during beta