The Advanced File Manager WordPress plugin prior to version 6.0.0 contains an output validation flaw that allows an authenticated user with‑file‑manager permissions to upload an SVG file that is not correctly identified as such before sanitisation. Malicious content, such as embedded JavaScript, is therefore not stripped and will execute in the browser of anyone who opens the file, including administrators. This client‑side injection can compromise user accounts, deface sites, or facilitate session hijacking.

The vulnerability affects every installation of the Advanced File Manager plugin with a release older than 6.0.0. All users of the 5.x branch are impacted, regardless of the specific sub‑version, as the flaw applies across the entire 5.x code base. Administrators who grant file‑manager access to other users are at particular risk because they enable the upload path that triggers the flaw.

The CVSS score of 7.1 indicates a high impact with medium complexity, requiring authenticated access to the file‑manager feature. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the likely attack vector is an authenticated file upload by a user with file‑manager privileges; once a malicious SVG is stored, any user—including privileged administrators—will trigger the XSS when the file is opened.