UNKNOWN NVD

CVE-2026-79627

The Advanced File Manager WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users grant

The Advanced File Manager WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager access by an administrator to store a file containing script that is not stripped and that runs in the browser of anyone who opens it, including an administrator.

References

https://wpscan.com/vulnerability/e6a56b2e-71dc-41cb-8a57-091b5ff47440/

Published: 2026-10-21 · Source: NVD · Feed updated: 2026-10-21

This unknown severity vulnerability was published on 2026-10-21 via NVD.

vulnfeed aggregates 17594 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.