Plugin icon

File Manager

file-manager

Vulnerabilities:

12

Last Updated:

August 3, 2026

Active Installs:

10000

Published
Title
Fixed in
CVSS
Published
2026-08-05
Title
File Manager 6.0 - 6.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read and Deletion via 'cmd' Query Parameter
Fixed in
Fixed in 6.9.1
CVSS
8.8 (high)
Published
2026-08-04
Title
Bit File Manager < 6.9.1 - Unauthenticated File Activity Log Disclosure
Fixed in
Fixed in 6.9.1
CVSS
5.3 (medium)
Published
2026-08-04
Title
Bit File Manager < 6.9.1 - Subscriber+ Sensitive Data Disclosure via bitapps_fm_connector
Fixed in
Fixed in 6.9.1
CVSS
6.5 (medium)
Published
2026-08-04
Title
Bit File Manager < 6.9.1 - Subscriber+ Arbitrary File Read and Deletion via Connector Command Request-Source Mismatch
Fixed in
Fixed in 6.9.1
CVSS
8.8 (high)
Published
2025-06-02
Title
Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress < 6.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Uploads
Fixed in
Fixed in 6.8
CVSS
6.4 (medium)
Published
2024-10-04
Title
Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress < 6.5.8 - Authenticated (Subscriber+) Limited JavaScript File Upload
Fixed in
Fixed in 6.5.8
CVSS
6.8 (medium)
Published
2024-09-09
Title
Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress < 6.5.6 - Authenticated (Subscriber+) Arbitrary File Upload
Fixed in
Fixed in 6.5.6
CVSS
8.8 (high)
Published
2024-09-04
Title
Bit File Manager 6.0 - 6.5.5 - Unauthenticated Remote Code Execution via Race Condition
Fixed in
Fixed in 6.5.6
CVSS
8.1 (high)
Published
2023-11-20
Title
File Manager < 6.3 - Admin+ Arbitrary OS File/Folder Access + Path Traversal
Fixed in
Fixed in 6.3
CVSS
5.5 (medium)
Published
2022-03-14
Title
Library File Manager < 5.2.3 - Subscriber+ Arbitrary File Creation/Upload/Deletion
Fixed in
Fixed in 5.2.3
CVSS
9.9 (critical)
Published
2018-03-02
Title
File Manager < 5.0.2 - Information Disclosure
Fixed in
Fixed in 5.0.2
CVSS
7.5 (high)
Published
2017-03-01
Title
File Manager <= 4.1.4 - Cross-Site Request Forgery (CSRF) Arbitrary File Upload
Fixed in
Fixed in 4.1.5
CVSS
n/a