6.8Medium

CVE-2024-8743Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress <= 6.5.7 - Authenticated (Subscriber+) Limited JavaScript File Upload

bitpressadmin File Manager; bitapps file_manager Published: 2024-10-05 09:44 (2 years ago)

Description

The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up to, and including, 6.5.7. This is due to a lack of proper checks on allowed file types. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an administrator, to upload .css and .js files, which could lead to Stored Cross-Site Scripting.

Weakness (CWE): CWE-434

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
bitapps	file_manager	< 6.5.8
bitpressadmin	File Manager	≤ 6.5.7

References and patches

CVSS score

6.8Medium

Source: Wordfence · CVSS 3.1

Attack vector: Network
Attack complexity: High
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: None

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS (chance of exploitation in 30 days)

0.83%

higher than 58% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: total

Timeline

ID reserved2024-09-11
Published2024-10-05 09:44
Reached IP-DB2026-10-24 23:54
Last updated2026-04-08 19:45

Assigned by (CNA): Wordfence

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — WordPress plugins & themes

6.5Medium

CVE-2026-125796 4 hours ago

WordPress JS Help Desk plugin <= 5.0.5 - Broken Access Control vulnerability

Ahmad JS Help Desk

Missing Authorization vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 5.0.5.

7.1High

CVE-2026-125830 4 hours ago

WordPress belingoGeo plugin <= 1.13.3 - Cross Site Scripting (XSS) vulnerability

Belingo belingoGeo

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Belingo belingoGeo belingogeo allows Reflected XSS.This issue affects belingoGeo: from n/a through 1.13.3.

5.0Medium

CVE-2026-125826 4 hours ago

WordPress PowerPress Podcasting plugin <= 11.18.3 - Arbitrary File Deletion vulnerability

Blubrry Podcasting PowerPress Podcasting

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Path Traversal.This issue affects PowerPress Podcasting: from n/a through 11.18.3.

7.5High

CVE-2026-125823 4 hours ago

WordPress Gutenverse plugin <= 4.2.2 - Denial of Service Attack vulnerability

Jegstudio Gutenverse

Allocation of Resources Without Limits or Throttling vulnerability in Jegstudio Gutenverse gutenverse allows HTTP DoS.This issue affects Gutenverse: from n/a through 4.2.2.

7.1High

CVE-2026-125818 4 hours ago

WordPress wpDiscuz plugin <= 7.6.75 - Cross Site Scripting (XSS) vulnerability

AdvancedCoding wpDiscuz

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Stored XSS.This issue affects wpDiscuz: from n/a through 7.6.75.

7.1High

CVE-2026-125804 4 hours ago

WordPress AI Engine plugin <= 3.9.3 - Cross Site Scripting (XSS) vulnerability

Meow Apps AI Engine

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meow Apps AI Engine ai-engine allows Stored XSS.This issue affects AI Engine: from n/a through 3.9.3.