CVE-2018-16363

MEDIUM NUCLEI

File Manager plugin 2.9 for WordPress - Stored Cross-Site Scripting via lang Parameter

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2018-16363 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wp_file_manager request because set_transient is used in file_folder_manager.php and there is an echo of lang in lib\wpfilemanager.php.

Nuclei Templates (1)

WordPress File Manager < 3.0 - Cross-Site Scripting
MEDIUMVERIFIEDby Shivam Kamboj

References (4)

Core 4
Core References
Exploit, Third Party Advisory x_refsource_misc
http://blog.51cto.com/010bjsoft/2171087
Patch, Third Party Advisory x_refsource_misc
https://plugins.trac.wordpress.org/changeset/1936043
Patch, Third Party Advisory x_refsource_misc
https://wpvulndb.com/vulnerabilities/9126

Scores

CVSS v3 5.4
EPSS 0.0138
EPSS Percentile 68.5%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (1)
filemanagerpro/file_manager 2.9
Published Sep 07, 2018
Tracked Since Feb 18, 2026