{"id":"CVE-2026-79627","aliases":["EUVD-2026-107081","GHSA-3846-mpmc-4v59"],"status":"published","title":"Advanced File Manager 5.4.13 - 5.4.14 - Authenticated Stored XSS via SVG Sanitiser Content-Sniff Bypass","description":"The Advanced File Manager  WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager access by an administrator to store a file containing script that is not stripped and that runs in the browser of anyone who opens it, including an administrator.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00266,"percentile":0.18907,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-10-21T06:00:24Z","modified":"2026-10-21T18:37:38Z","products":[{"vendor":"saad iqbal","product":"advanced file manager"},{"vendor":"unknown","product":"advanced file manager"}],"references":[{"url":"https://wpscan.com/vulnerability/e6a56b2e-71dc-41cb-8a57-091b5ff47440/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79627"},{"url":"https://wpscan.com/vulnerability/e6a56b2e-71dc-41cb-8a57-091b5ff47440"},{"url":"https://github.com/advisories/GHSA-3846-mpmc-4v59"}],"sources":{"cve":[{"id":"CVE-2026-79627","title":"Advanced File Manager 5.4.13 - 5.4.14 - Authenticated Stored XSS via SVG Sanitiser Content-Sniff Bypass","description":"The Advanced File Manager  WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager access by an administrator to store a file containing script that is not stripped and that runs in the browser of anyone who opens it, including an administrator.","status":"published","published":"2026-10-21T06:00:24.077Z","modified":"2026-10-21T10:35:02.461Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:50:38.739766Z"}],"euvd":[{"id":"EUVD-2026-107081","description":"The Advanced File Manager  WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager access by an administrator to store a file containing script that is not stripped and that runs in the browser of anyone who opens it, including an administrator.","status":"published","published":"2026-10-21T06:00:24Z","modified":"2026-10-21T10:35:02Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:59:40.152045Z"}],"ghsa":[{"id":"GHSA-3846-mpmc-4v59","title":"The Advanced File Manager  WordPress plugin before 6.0.0 does not correctly determine whether a...","description":"The Advanced File Manager  WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager access by an administrator to store a file containing script that is not stripped and that runs in the browser of anyone who opens it, including an administrator.","status":"published","published":"2026-10-21T06:31:15Z","modified":"2026-10-21T12:32:12Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:14:09.697532Z"}],"nvd":[{"id":"CVE-2026-79627","description":"The Advanced File Manager  WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager access by an administrator to store a file containing script that is not stripped and that runs in the browser of anyone who opens it, including an administrator.","status":"published","published":"2026-10-21T06:16:49.623Z","modified":"2026-10-21T18:37:38.7Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:13:02.045979Z"}]}}