WordPress plugin
Frontend File Manager Plugin security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical6
- High11
- Medium17
- Low0
All Frontend File Manager Plugin vulnerabilities
- High7.2Unauthenticated Stored Cross-Site Scripting
≤23.6No patch available
- Critical9.1Unauthenticated Arbitrary File Deletion
≤23.6No patch available
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion
≤23.6No patch available
- High7.5Missing Authorization to Unauthenticated Arbitrary File Sharing via 'file_id' Parameter
≤23.5Update to 23.6
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion
≤23.4Update to 23.5
- High7.5Missing Authorization to Unauthenticated Arbitrary Post Deletion
≤21.5Update to 22.0
- Critical9.1Authenticated (Editor+) Directory Traversal
≤22.5Update to 22.6
- High8.8Cross-Site Request Forgery to File Upload
≤21.2Update to 21.3
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
≤21.2Update to 21.3
- High8.8Cross-Site Request Forgery to Plugin Settings Update
≤21.3Update to 21.4
- Critical9.0Unauthenticated Arbitrary File Download
<18.3Update to 18.3
- High7.2Unauthenticated Stored Cross-Site Scripting
<18.3Update to 18.3
- High7.2Unauthenticated HTML Injection leading to Spam Emails
<18.3Update to 18.3
- Critical9.9Authenticated Settings Change leading to Arbitrary File Upload
<18.3Update to 18.3
- Critical9.8Arbitrary File Upload
<4.0Update to 4.0
- Critical9.8Arbitrary File Upload
≤3.7Update to 3.8
- High8.8Arbitrary File Upload
<3.6Update to 3.6
Frontend File Manager Plugin: common questions
Does Frontend File Manager Plugin have known vulnerabilities?
Yes. VulnCrest Radar lists 34 known vulnerabilities in Frontend File Manager Plugin: 6 critical, 11 high, 17 medium. At least one is not fixed in the latest version.
How do I check which version of Frontend File Manager Plugin I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Frontend File Manager Plugin vulnerability?
CVE-2026-32577, published Oct 4, 2026: Frontend File Manager Plugin <= 23.6 - Unauthenticated Stored Cross-Site Scripting. Severity: High (CVSS 7.2).
Is any Frontend File Manager Plugin vulnerability listed in CISA KEV?
No. None of the known Frontend File Manager Plugin vulnerabilities is currently listed in the CISA KEV catalog.