The vulnerability allows an unauthenticated attacker to inject arbitrary JavaScript code into the WordPress admin interface through the "soundFile" parameter. Because the input is stored without proper sanitization or escaping, the malicious script runs whenever an authenticated administrator visits an attacker‑controlled page that is loaded while the File Manager screen is open. This can lead to credential theft, session hijacking, or full compromise of the WordPress site if the attacker controls a site that shares a common prefix with the target’s backend URL. The likely attack vector is reflected cross‑site scripting via a postMessage "soundFile" parameter, inferred from the description and the plugin’s handling of that parameter.

The flaw exists in the Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution plugin for WordPress, affecting all releases up to and including version 5.4.12. WordPress administrators using these versions without an applied fix are susceptible.

The CVSS score of 6.1 indicates a moderate risk, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to host content on a domain whose origin string is a leading prefix of the target site's backend URL (for example, https://example.co against https://example.com) and the victim must be an authenticated administrator who visits the malicious page while the File Manager admin screen remains open. While this scenario limits the attack surface, the potential impact of script execution in an admin context is significant.