Unknown Frontend File Manager Plugin vulnerabilities

8 CVEs affecting Unknown Frontend File Manager Plugin, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-16292, published 2026-08-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-0829, published 2026-02-17. Medium severity, CVSS 5.8. EPSS: 0.7% chance of exploitation in the next 30 days. The Frontend File Manager Plugin WordPress plugin through 23.5 allows unauthenticated users to send emails through the site without any security checks. This lets attackers use the WordPress site as…
CVE-2026-8380, published 2026-06-26. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly verify ownership of every targeted post before permanent deletion, allowing authenticated users with author-level…
CVE-2026-8379, published 2026-06-23. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly enforce its nonce check on the file download handler, allowing unauthenticated attackers to download files uploaded by…
CVE-2026-12277, published 2026-07-07. High severity, CVSS 8.7. EPSS: 0.4% chance of exploitation in the next 30 days. The Frontend File Manager Plugin WordPress plugin through 23.6 does not validate a file path derived from user input before deleting the referenced file, allowing unauthenticated users to delete…
CVE-2026-5337, published 2026-05-03. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. During the analysis, it was identified that authenticated attackers with Subscriber-level access or higher are able to perform an Insecure Direct Object Reference (IDOR) attack. This vulnerability…
CVE-2025-14804, published 2026-01-07. High severity, CVSS 7.7. EPSS: 0.3% chance of exploitation in the next 30 days. The Frontend File Manager Plugin WordPress plugin before 23.5 did not validate a path parameter and ownership of the file, allowing any authenticated users, such as subscribers to delete arbitrary…
CVE-2026-8378, published 2026-06-23. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. The Frontend File Manager Plugin WordPress plugin through 23.6 does not sanitise nor escape a filename submitted to the frontend file-rename endpoint before storing it as post meta and rendering it…
CVE-2026-16292, published 2026-08-02. Medium severity, CVSS 5.4. EPSS: 0.1% chance of exploitation in the next 30 days. The Frontend File Manager Plugin WordPress plugin through 23.6 does not perform nonce validation on one of its file-metadata update actions, allowing an attacker to modify the metadata of a logged-in…