FileBird – WordPress Media Library Folders & File Manager: Author-level stored XSS through image alternative text
The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions up to, and including, 6.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The export does not identify which FileBird view or rendering function uses the alt text. Script execution requires a viewer of affected content. Affected versions reported by the CNA: <= 6.5.6. No fixed release is confirmed for this CVE in this review.
- Component
- FileBird – WordPress Media Library Folders & File Manager
- Plugin slug
filebird- Affected
- <= 6.5.6
- Safe version
- See mitigation notes
- Published
- Sep 18, 2026
This CVE was published Sep 18, 2026 and is one of 10 known issues for this plugin.
Update, patch or deactivate.
The official changelog was checked against the currently listed 6.5.8 release, but no clear fix for this specific issue was confirmed. A newer release may resolve it; do not treat the version number or a generic security entry as proof. Official changelog: https://wordpress.org/plugins/filebird/#developers Treat alt text as text, not markup, and escape it for each HTML attribute or text-node context. Restrict untrusted media editing and remove injected saved values.
No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions up to, and including, 6.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N