VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Simple File List security & vulnerabilities

simple-file-list— active installsLast vulnerability Oct 5, 2026

Unpatched vulnerability in the latest version

At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.

Watch plugin
22Known vulnerabilities
  • Critical3
  • High7
  • Medium12
  • Low0
Vulnerabilities per year
2019: 2 vulnerabilities2192020: 2 vulnerabilities2202022: 3 vulnerabilities3222023: 3 vulnerabilities3232024: 1 vulnerability1242025: 3 vulnerabilities3252026: 8 vulnerabilities826

All Simple File List vulnerabilities

Simple File List vulnerabilities
SeverityVulnerabilityCVEPublished
Critical9.1Unauthenticated Arbitrary File Deletion
≤6.3.11No patch available
CVE-2026-39792
High7.5Unauthenticated Arbitrary File Read
≤6.3.11No patch available
CVE-2026-16616
High7.2Unauthenticated Stored Cross-Site Scripting
≤6.3.11No patch available
CVE-2026-16617
Medium6.1Reflected Cross-Site Scripting
≤6.3.8Update to 6.3.9
CVE-2026-57382
Medium6.5Missing Authorization to Authenticated (Contributor+) Arbitrary File Operations (Deletion / Move / Folder Creation / Download) via 'frontmanage' Shortcode Attribute
≤6.3.7Update to 6.3.8
CVE-2026-12119
High7.5Unauthenticated Arbitrary File Deletion via Path Traversal in 'eeSubFolder' Parameter
≤6.3.7Update to 6.3.8
CVE-2026-11911
High7.5Missing Authorization to Unauthenticated File Modification via simplefilelist_edit_job AJAX Action
≤6.3.7Update to 6.3.8
CVE-2026-11912
Medium6.5Authenticated (Subscriber+) Arbitrary File Download
≤6.1.15Update to 6.1.16
CVE-2026-24953
Medium4.3Missing Authorization
≤6.3.7Update to 6.3.8
CVE-2025-68591
Medium5.3Unauthenticated Arbitrary File Download
≤6.1.14Update to 6.1.15
CVE-2025-54021
Medium5.3Missing Authorization to Unauthenticated Minor Settings Update
≤6.1.13Update to 6.1.14
CVE-2025-47450
Medium6.1Reflected Cross-Site Scripting
≤6.1.12Update to 6.1.13
CVE-2024-10146
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via settings
≤6.1.9Update to 6.1.10
CVE-2023-39924
Critical9.1Unauthenticated Arbitrary File Deletion
≤6.1.9Update to 6.1.10
CVE-2023-44227
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤6.0.9Update to 6.0.10
CVE-2023-1025
High8.8Cross-Site Request Forgery to Page Creation
≤4.4.12Update to 4.4.13
CVE-2022-3208
Medium6.1Reflected Cross-Site Scripting
≤4.4.11Update to 4.4.12
CVE-2022-3207
Medium6.1Reflected Cross-Site Scripting
≤4.4.11Update to 4.4.12
CVE-2022-3062
Critical9.8Remote Code Execution
<4.2.3Update to 4.2.3
CVE-2020-36847
Medium6.5Arbitrary File Deletion
≤4.2.7Update to 4.2.8
CVE-2020-12832
High8.6Arbitrary File Deletion
≤3.2.4Update to 3.2.5
—
High7.5Arbitrary File Download
≤3.2.7Update to 3.2.8
CVE-2022-1119

Simple File List: common questions

Does Simple File List have known vulnerabilities?

Yes. VulnCrest Radar lists 22 known vulnerabilities in Simple File List: 3 critical, 7 high, 12 medium. At least one is not fixed in the latest version.

How do I check which version of Simple File List I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Simple File List vulnerability?

CVE-2026-39792, published Oct 5, 2026: Simple File List <= 6.3.11 - Unauthenticated Arbitrary File Deletion. Severity: Critical (CVSS 9.1).

Is any Simple File List vulnerability listed in CISA KEV?

No. None of the known Simple File List vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?