WordPress plugin
Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 15 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High6
- Medium9
- Low0
All Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium6.4 | Authenticated (Custom Role+) Stored Cross-Site Scripting <6.0.0Update to 6.0.0 | CVE-2026-79627 | |
| Medium4.3 | Missing Authorization ≤5.4.14Update to 6.0.0 | CVE-2026-110365 | |
| Medium4.3 | Missing Authorization ≤5.4.12Update to 5.4.13 | CVE-2026-11565 | |
| Medium6.1 | Reflected Cross-Site Scripting via postMessage 'soundFile' Parameter ≤5.4.12Update to 5.4.13 | CVE-2026-15009 | |
| High7.2 | Authenticated Remote Code Execution <8.0.4Update to 8.0.4 | CVE-2026-6382 | |
| Medium6.5 | Directory Traversal to Arbitrary File Deletion ≤1.8.9Update to 1.9 | CVE-2025-0818 | |
| Medium5.3 | Missing Authorization to Notice Dismisaal ≤5.3.1Update to 5.3.2 | CVE-2025-47688 | |
| Medium6.4 | Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload ≤5.2.14Update to 5.3.0 | CVE-2024-13805 | |
| High7.5 | 5.2.13 - Authenticated (Subscriber+) Arbitrary File Upload 5.2.12 – 5.2.13Update to 5.2.14 | CVE-2024-13333 | |
| High7.5 | Authenticated (Subscriber+) Arbitrary File Upload ≤5.2.10Update to 5.2.11 | CVE-2024-11391 | |
| High7.5 | Authenticated (Subscriber+) Arbitrary File Upload ≤5.2.8Update to 5.2.9 | CVE-2024-8126 | |
| Medium6.8 | Authenticated (Subscriber+) Limited File Upload ≤5.2.8Update to 5.2.9 | CVE-2024-8725 | |
| High7.2 | Authenticated (Administrator+) Local JavaScript File Inclusion via fma_locale ≤5.2.8Update to 5.2.9 | CVE-2024-8704 | |
| High7.5 | Sensitive Information Exposure via Directory Listing ≤5.2.4Update to 5.2.5 | CVE-2024-5598 | |
| Medium6.6 | Authenticated (Administrator+) Arbitrary File and Folder Access ≤5.1Update to 5.1.1 | CVE-2023-3814 |
- Medium6.4Authenticated (Custom Role+) Stored Cross-Site Scripting
<6.0.0Update to 6.0.0
- Medium4.3Missing Authorization
≤5.4.14Update to 6.0.0
- Medium4.3Missing Authorization
≤5.4.12Update to 5.4.13
- Medium6.1Reflected Cross-Site Scripting via postMessage 'soundFile' Parameter
≤5.4.12Update to 5.4.13
- High7.2Authenticated Remote Code Execution
<8.0.4Update to 8.0.4
- Medium6.5Directory Traversal to Arbitrary File Deletion
≤1.8.9Update to 1.9
- Medium5.3Missing Authorization to Notice Dismisaal
≤5.3.1Update to 5.3.2
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload
≤5.2.14Update to 5.3.0
- High7.55.2.13 - Authenticated (Subscriber+) Arbitrary File Upload
5.2.12 – 5.2.13Update to 5.2.14
- High7.5Authenticated (Subscriber+) Arbitrary File Upload
≤5.2.10Update to 5.2.11
- High7.5Authenticated (Subscriber+) Arbitrary File Upload
≤5.2.8Update to 5.2.9
- Medium6.8Authenticated (Subscriber+) Limited File Upload
≤5.2.8Update to 5.2.9
- High7.2Authenticated (Administrator+) Local JavaScript File Inclusion via fma_locale
≤5.2.8Update to 5.2.9
- High7.5Sensitive Information Exposure via Directory Listing
≤5.2.4Update to 5.2.5
- Medium6.6Authenticated (Administrator+) Arbitrary File and Folder Access
≤5.1Update to 5.1.1
Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution: common questions
Does Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution have known vulnerabilities?
Yes. VulnCrest Radar lists 15 known vulnerabilities in Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution: 6 high, 9 medium. None are known to affect version null.
How do I check which version of Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution vulnerability?
CVE-2026-79627, published Oct 21, 2026: Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution < 6.0.0 - Authenticated (Custom Role+) Stored Cross-Site Scripting. Severity: Medium (CVSS 6.4).
Is any Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution vulnerability listed in CISA KEV?
No. None of the known Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution vulnerabilities is currently listed in the CISA KEV catalog.