The Frontend File Manager Plugin for WordPress allows a file rename action to be performed via a front‑end endpoint. Filenames submitted through this endpoint are stored as post meta and later rendered back to the admin File Manager interface without any sanitisation or escaping. Consequently, a malicious user with Subscriber level access or higher can store a crafted filename that contains JavaScript, which will be executed when an administrator views the file list, allowing the attacker to run arbitrary code in the context of the admin account.

This flaw affects the Frontend File Manager Plugin for WordPress versions through 23.6. Users running any of those versions are potentially exposed, regardless of their overall WordPress setup.

No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, but the attack path is straightforward: a low‑privilege user can submit a malicious filename, and the stored value will trigger a browser script execution when the admin navigates the file manager. The impact on confidentiality, integrity, and availability is significant because it permits arbitrary code execution on the administrator’s session. With a high impact and a clear, trivial exploitation path, the overall risk is considered substantial.