Plugin icon

Simple File List

simple-file-list
Plugin closed

Vulnerabilities:

23

Last Updated:

June 22, 2026

Active Installs:

3000

Published
Title
Fixed in
CVSS
Published
2026-10-05
Title
Simple File List <= 6.3.11 - Unauthenticated Arbitrary File Deletion
Fixed in
No known fix
CVSS
9.1 (critical)
Published
2026-08-17
Title
Simple File List <= 6.3.11 - Unauthenticated Arbitrary File Read and Move via Path Traversal
Fixed in
No known fix
CVSS
8.6 (high)
Published
2026-08-17
Title
Simple File List <= 6.3.11 - Unauthenticated Stored XSS via File Description
Fixed in
No known fix
CVSS
8.8 (high)
Published
2026-07-07
Title
Simple File List < 6.3.9 - Reflected Cross-Site Scripting
Fixed in
Fixed in 6.3.9
CVSS
6.1 (medium)
Published
2026-06-19
Title
Simple File List < 6.3.8 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Operations (Deletion / Move / Folder Creation / Download) via 'frontmanage' Shortcode Attribute
Fixed in
Fixed in 6.3.8
CVSS
4.9 (medium)
Published
2026-06-19
Title
Simple File List < 6.3.8 - Unauthenticated Arbitrary File Deletion via Path Traversal in 'eeSubFolder' Parameter
Fixed in
Fixed in 6.3.8
CVSS
7.5 (high)
Published
2026-06-19
Title
Simple File List < 6.3.8 - Missing Authorization to Unauthenticated File Modification via simplefilelist_edit_job AJAX Action
Fixed in
Fixed in 6.3.8
CVSS
7.5 (high)
Published
2026-02-09
Title
Simple File List < 6.1.16 - Authenticated (Subscriber+) Arbitrary File Download
Fixed in
Fixed in 6.1.16
CVSS
6.5 (medium)
Published
2025-12-25
Title
Simple File List < 6.3.8 - Missing Authorization
Fixed in
Fixed in 6.3.8
CVSS
4.3 (medium)
Published
2025-07-28
Title
Simple File List < 6.1.15 - Unauthenticated Arbitrary File Download
Fixed in
Fixed in 6.1.15
CVSS
5.3 (medium)
Published
2025-05-07
Title
Simple File List < 6.1.14 - Missing Authorization to Unauthenticated Minor Settings Update
Fixed in
Fixed in 6.1.14
CVSS
5.3 (medium)
Published
2024-10-24
Title
Simple File List < 6.1.13 - Reflected Cross-Site Scripting
Fixed in
Fixed in 6.1.13
CVSS
7.1 (high)
Published
2023-10-12
Title
Simple File List < 6.1.10 - Admin+ Stored XSS
Fixed in
Fixed in 6.1.10
CVSS
3.5 (low)
Published
2023-09-28
Title
Simple File List < 6.1.10 - Unauthenticated Arbitrary File Deletion
Fixed in
Fixed in 6.1.10
CVSS
9.1 (critical)
Published
2023-02-28
Title
Simple File List < 6.0.10 - Admin+ Stored XSS
Fixed in
Fixed in 6.0.10
CVSS
3.5 (low)
Published
2022-09-19
Title
Simple File List < 4.4.13 - Page Creation via CSRF
Fixed in
Fixed in 4.4.13
CVSS
5.4 (medium)
Published
2022-09-19
Title
Simple File List < 4.4.12 - Admin+ Stored Cross-Site Scripting
Fixed in
Fixed in 4.4.12
CVSS
3.4 (low)
Published
2022-08-30
Title
Simple File List < 4.4.12 - Reflected Cross-Site Scripting
Fixed in
Fixed in 4.4.12
CVSS
6.1 (medium)
Published
2020-05-16
Title
Simple File List < 4.2.8 - Authenticated Arbitrary File Deletion
Fixed in
Fixed in 4.2.8
CVSS
8.1 (high)
Published
2020-04-27
Title
Simple File List < 4.2.3 - Unauthenticated Arbitrary File Upload RCE
Fixed in
Fixed in 4.2.3
CVSS
10.0 (critical)
Published
2019-06-02
Title
Simple File List < 3.2.8 - Unauthenticated Arbitrary File Download
Fixed in
Fixed in 3.2.8
CVSS
7.5 (high)
Published
2019-05-23
Title
Simple File List Plugin <= 3.2.4 - Authenticated Arbitrary File Delete
Fixed in
Fixed in 3.2.5
CVSS
n/a
Published
2019-05-23
Title
Simple File List Plugin < 3.2.8 - Unauthenticated Arbitrary File Download
Fixed in
Fixed in 3.2.8
CVSS
n/a