An unauthenticated cross-site scripting (XSS) flaw exists in the WordPress Frontend File Manager plugin versions up to 23.6. The flaw permits an attacker to inject malicious script code that will run in the context of a user’s browser when they interact with the plugin’s interface. This can lead to session hijacking, cookie theft, defacement of websites, and execution of arbitrary client-side attacks that could compromise the user’s data or the site’s integrity.

The vulnerability affects installations of the N-Media Frontend File Manager plugin whose version is 23.6 or earlier. All WordPress sites that have this plugin active and have not yet applied an update beyond 23.6 are susceptible.

The CVSS score of 7.1 indicates a high severity. Since the attack requires no authentication and the plugin often operates on the front-end for file management, the potential for exploitation is broad. The EPSS score of 0.00237 indicates a very low probability of exploitation, but the lack of a need for privileged access and the public availability of malicious code in the web context increases the likelihood of exploitation. The VDB indicates this issue is not listed in CISA’s KEV catalog, yet administrators should still consider it a critical threat for unpatched sites.