Plugin icon

File Manager

wp-file-manager

Vulnerabilities:

14

Last Updated:

September 22, 2026

Active Installs:

1000000

Published
Title
Fixed in
CVSS
Published
2026-09-24
Title
File Manager 7.2.2 - 8.0.4 - Unauthenticated Database Backup Disclosure
Fixed in
Fixed in 8.0.5
CVSS
5.9 (medium)
Published
2026-09-24
Title
Multiple elFinder Plugins - DOM-based XSS via postMessage Origin Bypass
Fixed in
Fixed in 8.0.5
CVSS
7.5 (high)
Published
2026-06-15
Title
Multiple elFinder Plugins - Authenticated OS Command Injection
Fixed in
Fixed in 8.0.4
CVSS
9.1 (critical)
Published
2024-06-27
Title
File Manager < 7.2.8 - Missing Authorization
Fixed in
Fixed in 7.2.8
CVSS
4.3 (medium)
Published
2024-04-03
Title
File Manager < 7.2.6 - Authenticated (Administrator+) Directory Traversal
Fixed in
Fixed in 7.2.6
CVSS
6.8 (medium)
Published
2024-03-20
Title
File Manager < 7.2.5 - Cross-Site Request Forgery to Local JS File Inclusion
Fixed in
Fixed in 7.2.5
CVSS
8.8 (high)
Published
2024-03-04
Title
File Manager And File Manager Pro (Multiple Versions) - Directory Traversal
Fixed in
Fixed in 7.2.2
CVSS
9.9 (critical)
Published
2024-01-22
Title
File Manager < 7.2.2 - Sensitive Information Exposure via Backup Filenames
Fixed in
Fixed in 7.2.2
CVSS
8.1 (high)
Published
2021-02-26
Title
WP File Manager < 7.1 - Reflected Cross-Site Scripting (XSS)
Fixed in
Fixed in 7.1
CVSS
5.8 (medium)
Published
2020-09-01
Title
File Manager 6.0-6.9 - Unauthenticated Arbitrary File Upload leading to RCE
Fixed in
Fixed in 6.9
CVSS
10.0 (critical)
Published
2020-08-10
Title
File Manager < 6.5 - Backup File Directory Listing
Fixed in
Fixed in 6.5
CVSS
5.3 (medium)
Published
2019-07-10
Title
File Manager < 5.2 - Multiple Vulnerabilities
Fixed in
Fixed in 5.2
CVSS
8.3 (high)
Published
2018-09-17
Title
File Manager < 3.1 - CSRF to Stored Cross-Site Scripting
Fixed in
Fixed in 3.1
CVSS
5.8 (medium)
Published
2018-09-06
Title
File Manager < 3.0 - Authenticated Reflected Cross-Site Scripting (XSS)
Fixed in
Fixed in 3.0
CVSS
9.6 (critical)