High severity · published Sep 26, 2026
CVE-2026-85081
Multiple elFinder Plugins - DOM-based XSS via postMessage Origin Bypass
7.5
CVSS
0.2%
EPSS
No
On KEV
Description
The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading string prefix of the site's own address, which allows an unauthenticated attacker to run arbitrary JavaScript in the session of a logged-in administrator who visits a page under their control.
The defect is in the file-manager library all three bundle, and every version below 2.1.70 carries it. Updating the bundled library closes it.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FM
File Manager ·
before 8.0.5 · source: vendor
FM
File Manager Pro ·
before 2.1.3 · source: vendor
FI
FileOrganizer ·
before 1.2.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-85081
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-85081
wpscan.com
https://wpscan.com/vulnerability/3c5f9c52-e609-45aa-b441-491e15b3f4b8/
More from File Manager
9.1
CVE-2026-6382
Multiple elFinder Plugins - Authenticated OS Command Injection
8.8
CVE-2026-17540
Bit File Manager < 6.9.1 - Subscriber+ Arbitrary File Read and Deletion via Connector Command Request-Source Mismatch
7.5
CVE-2026-17542
Bit File Manager < 6.9.1 - Subscriber+ Sensitive Data Disclosure via bitapps_fm_connector
7.5
CVE-2026-17541
Bit File Manager < 6.9.1 - Unauthenticated File Activity Log Disclosure
6.5
CVE-2023-5907
File Manager < 6.3 - Admin+ Arbitrary OS File/Folder Access + Path Traversal