WordPress plugin
Frontend File Manager Plugin security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical6
- High11
- Medium17
- Low0
All Frontend File Manager Plugin vulnerabilities
- High7.2Unauthenticated Stored Cross-Site Scripting
≤23.6No patch available
- Critical9.1Unauthenticated Arbitrary File Deletion
≤23.6No patch available
- Medium4.3Cross-Site Request Forgery
≤23.6No patch available
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion
≤23.6No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤23.6No patch available
- Medium5.3Missing Authorization to Unauthenticated File Download
≤23.6No patch available
- Medium4.3Missing Authorization to Authenticated (Author+) Arbitrary Post Deletion
≤23.6No patch available
- Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Download Access
≤23.6No patch available
- Medium5.3Missing Authorization
≤23.5No patch available
- High7.5Missing Authorization to Unauthenticated Arbitrary File Sharing via 'file_id' Parameter
≤23.5Update to 23.6
- Medium5.3Unauthenticated Insecure Direct Object Reference
≤23.5Update to 23.6
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion
≤23.4Update to 23.5
- Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary File Renaming
≤23.4Update to 23.5
- Medium4.3Missing Authorization
≤23.2Update to 23.3
- Medium5.3Missing Authorization
≤23.2Update to 23.4
- High7.5Missing Authorization to Unauthenticated Arbitrary Post Deletion
≤21.5Update to 22.0
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Content Injection
≤23.2No patch available
- Medium5.3Sensitive Information Exposure via user uploads
≤22.7Update to 22.8
- Critical9.1Authenticated (Editor+) Directory Traversal
≤22.5Update to 22.6
- High8.8Cross-Site Request Forgery to File Upload
≤21.2Update to 21.3
- Medium6.5Missing Authorization
≤21.2Update to 21.3
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
≤21.2Update to 21.3
- High8.8Cross-Site Request Forgery to Plugin Settings Update
≤21.3Update to 21.4
- Medium6.4Privilege Escalation
<18.3Update to 18.3
- Critical9.0Unauthenticated Arbitrary File Download
<18.3Update to 18.3
- Medium5.8Unauthenticated Post Meta Change
<18.3Update to 18.3
- High7.2Unauthenticated Stored Cross-Site Scripting
<18.3Update to 18.3
- High7.2Unauthenticated HTML Injection leading to Spam Emails
<18.3Update to 18.3
- Critical9.9Authenticated Settings Change leading to Arbitrary File Upload
<18.3Update to 18.3
- Medium5.8Unauthenticated Content Injection
<18.3Update to 18.3
- Medium6.5Unauthenticated Arbitrary Post Deletion
<18.3Update to 18.3
- Critical9.8Arbitrary File Upload
<4.0Update to 4.0
- Critical9.8Arbitrary File Upload
≤3.7Update to 3.8
- High8.8Arbitrary File Upload
<3.6Update to 3.6
Frontend File Manager Plugin: common questions
Does Frontend File Manager Plugin have known vulnerabilities?
Yes. VulnCrest Radar lists 34 known vulnerabilities in Frontend File Manager Plugin: 6 critical, 11 high, 17 medium. At least one is not fixed in the latest version.
How do I check which version of Frontend File Manager Plugin I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Frontend File Manager Plugin vulnerability?
CVE-2026-32577, published Oct 4, 2026: Frontend File Manager Plugin <= 23.6 - Unauthenticated Stored Cross-Site Scripting. Severity: High (CVSS 7.2).
Is any Frontend File Manager Plugin vulnerability listed in CISA KEV?
No. None of the known Frontend File Manager Plugin vulnerabilities is currently listed in the CISA KEV catalog.