The vulnerability arises because the File Manager, FileManager Pro, and FileOrganizer WordPress plugins fail to correctly validate the origin of window messages received by the embedded file browser. The flaw allows an unauthenticated attacker to inject arbitrary JavaScript that executes in an administrator’s browser session (CWE-79). This DOM‑based XSS can be leveraged to hijack the administrator’s session, modify site content, or perform other privileged actions on the site.

All versions of the File Manager WordPress plugin before 8.0.5, the FileOrganizer plugin before 1.2.1, and the File Manager Pro plugin before 2.1.3 are impacted. The affected code resides in the bundled file‑manager library included in all three products; every version below 2.1.70 contains the flaw. Updating the library to 2.1.70 or newer removes the vulnerability.

The CVSS score of 7.5 indicates high severity. The EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The threat is not listed in CISA’s KEV catalog, indicating no known widespread exploitation at this time. An attacker could remotely inject and execute code in a privileged administrator’s browsing session through a crafted origin value, exploiting the origin bypass logic.