title: WP File Manager < 7.1 - Reflected Cross-Site Scripting (XSS)
description: In the default configuration of the File Manager WordPress plugin before 7.1, a Reflected XSS can occur on the endpoint /wp-admin/admin.php?page=wp_file_manager_properties when a payload is submitted on the User-Agent parameter. The payload is then reflected back on the web application response.
problem types: CWE-79 Cross-site Scripting (XSS)
affected:
{
product: File Manager
vendor: Unknown
versions:
lessThan: 7.1, status: affected, version: 7.1, versionType: custom
}