Description

Unauthenticated Cross Site Scripting (XSS) in WPIDE – File Manager & Code Editor <= 3.5.7 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-06T15:17:20.057Z",
  "pubdate": "2026-08-06T15:17:20.057Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in the WPIDE – File Manager & Code Editor plugin, specifically affecting versions 3.5.7 and prior. This security flaw enables remote, unauthenticated attackers to inject malicious client-side scripts, typically JavaScript, into the victim's browser session via the vulnerable web application.\nThe primary impact of this vulnerability involves the potential execution of arbitrary script code within the context of a user's browser session, which can lead to session hijacking, unauthorized administrative actions, sensitive data exposure, or defacement of the affected WordPress site. The affected systems are WordPress installations utilizing vulnerable versions of the WPIDE – File Manager & Code Editor plugin.\nRisk implications are significant due to the unauthenticated nature of the attack vector, requiring no prior privileges or interaction from authenticated users to initiate exploitation over the network. Threat actors possessing network access can leverage this flaw to compromise administrative integrity if an administrative user interacts with the maliciously crafted payload. Exploitation requirements are minimal, relying solely on the target application processing improperly sanitized input parameters provided via HTTP requests.",
  "technicalDetails": "The root cause of this vulnerability stems from insufficient input sanitization and output encoding of user-supplied data handled by the WPIDE – File Manager & Code Editor plugin in versions 3.5.7 and below. The application fails to properly validate and escape parameters before reflecting them back to the user or processing them within the administrative interface, thereby introducing a classic Cross-Site Scripting vector.\nThe vulnerable component resides within the request handling and parameter processing logic of the WPIDE plugin. Because the vulnerability is unauthenticated, network exposure is direct and broad; any remote attacker with network access to the target WordPress site can construct and transmit malicious HTTP requests without needing valid credentials or possessing pre-existing privilege levels.\nThe step-by-step attack flow proceeds as follows: First, the attacker crafts a malicious payload containing executable JavaScript encapsulated within HTML tags or event handlers. Second, the attacker transmits this payload via an HTTP request directed at the vulnerable endpoints exposed by the WPIDE plugin. Third, the application processes the input without adequate sanitization and reflects the payload or stores it in a context where it gets rendered by the browser. Finally, when an administrator or user views the affected interface, the browser parses and executes the injected script within the security context of the victim's session.\nThe behavior of the payload allows the execution of arbitrary JavaScript, which can access Document Object Model (DOM) elements, extract session cookies, perform unauthorized actions on behalf of the victim via AJAX requests, or redirect the user to malicious external sites. The post-exploitation impact includes full administrative compromise of the WordPress instance if the payload executes within an administrator's browser session, potentially allowing the attacker to install backdoors, modify core files, or execute server-side code."
}