Stored XSS in WordPress nmedia-user-file-uploader Plugin via File Rename (CVE-2026-8378)

Vulnerability Overview Vulnerability Name: Frontend File Manager Plugin <= 23.6 - Subscriber+ Stored Cross-Site Scripting via File Rename Vulnerability Type: Stored Cross-Site Scripting (Stored XSS) Vulnerability Description: The plugin fails to sanitize or escape filenames submitted at the frontend file rename endpoint, resulting in a stored cross-site scripting vulnerability. Attackers can exploit this vulnerability to target administrators when they view the file management interface. CVE Number: CVE-2026-8378 CVSS Score: 8.0 (High) Impact Scope Affected Plugin: nmedia-user-file-uploader Patch Status: No known fix available Remediation Current Status: The page indicates "PoC will be shown after the issue is fixed"; currently, there is no specific remediation plan. Additional Information Original Researcher: Mohamad Nour Almujarkesh Submitter: Mohamad Nour Almujarkesh Verification Status: Verified WPVDB ID: 19f5dd94-b16c-4ad2-9586-d15ddecf9805 Release Date: 2026-06-02 Date Added: 2026-06-02 Last Updated: 2026-06-02 References CVE: CVE-2026-8378 Classification Type: XSS OWASP Top 10: A7: Cross-Site Scripting (XSS) CWE: CWE-79 CVSS: 8.0 (High) Timeline Public Release Date: 2026-06-02 (approximately 24 days ago) Date Added: 2026-06-02 (approximately 24 days ago) Last Updated: 2026-06-02 (approximately 24 days ago) Related Vulnerabilities SEO Plugin by Squirrly SEO < 11.1.12 - Reflected Cross-Site Scripting Count Per Day <= 3.2.3 - notes.php note Parameter XSS Scanventory <= 11.3 - Reflected Cross-Site Scripting Gutenberg Blocks by Kadence Blocks - Page Builder Features < 3.2.38 - Contributor+ Stored Cross-Site Scripting Gallerio <= 1.0.1 - Reflected Cross-Site Scripting Summary This vulnerability involves the Frontend File Manager plugin and poses a risk of stored cross-site scripting. It affects version 23.6 and earlier. As there are currently no known fixes, users are advised to monitor official updates and upgrade promptly when available.

Goal Reached Thanks to every supporter — we hit 100%!

Stored XSS in WordPress nmedia-user-file-uploader Plugin via File Rename (CVE-2026-8378)