PULSE
ES
FEED
ransomaurora reclama a Allmand-Smith Limited · GB · Manufacturingransomn0n reclama a Hanjin Information Systems & Telecommunication Co., Ltd. · KR · Technologyransominterlock reclama a Coastal Alabama Community College · US · Educationransomsilentransomgroup reclama a Porter Hedges LLP · US · Professional Servicesransomhelix reclama a Westrock Coffee · US · Retail & E-Commerceransomakira reclama a Flextron Circuit Assembly · SG · Manufacturingransomakira reclama a Cascade Flooring America · US · Retail & E-Commerceransomhelix reclama a Hypertherm · US · Manufacturingransomeverest reclama a PLD Group · Otherransomeverest reclama a Lindauer Dornier · DE · Manufacturingransomeverest reclama a Lanham Associates · Professional Servicesransompear reclama a Adobe Insurance Brokers, LLC · US · Financial Servicesransomhyflock reclama a gabonmeca.com leak incident · GA · Manufacturingransomhyflock reclama a dangvuongcac · VN · Not Foundransomaurora reclama a Allmand-Smith Limited · GB · Manufacturingransomn0n reclama a Hanjin Information Systems & Telecommunication Co., Ltd. · KR · Technologyransominterlock reclama a Coastal Alabama Community College · US · Educationransomsilentransomgroup reclama a Porter Hedges LLP · US · Professional Servicesransomhelix reclama a Westrock Coffee · US · Retail & E-Commerceransomakira reclama a Flextron Circuit Assembly · SG · Manufacturingransomakira reclama a Cascade Flooring America · US · Retail & E-Commerceransomhelix reclama a Hypertherm · US · Manufacturingransomeverest reclama a PLD Group · Otherransomeverest reclama a Lindauer Dornier · DE · Manufacturingransomeverest reclama a Lanham Associates · Professional Servicesransompear reclama a Adobe Insurance Brokers, LLC · US · Financial Servicesransomhyflock reclama a gabonmeca.com leak incident · GA · Manufacturingransomhyflock reclama a dangvuongcac · VN · Not Found
← All CVEs
CVE WatchOct 21, 2026

CVE-2026-79627

The Advanced File Manager WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it,

CVSS

—

No CVSS

EPSS

—

KEV

—

Exploit Today

0

0-100

Published: Oct 21, 2026 · Last modified: Oct 21, 2026

EPSS · 30d

Not enough EPSS history yet.

Technical description

The Advanced File Manager WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager access by an administrator to store a file containing script that is not stripped and that runs in the browser of anyone who opens it, including an administrator.

Official references
Related CVEs

No related CVEs by CWE or product.