WordPress plugin
File Manager Pro security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 8 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical1
- High5
- Medium2
- Low0
All File Manager Pro vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium6.5 | Directory Traversal to Arbitrary File Deletion ≤1.8.9Update to 1.9 | CVE-2025-0818 | |
| High7.4 | Unauthenticated Limited JavaScript File Upload ≤8.3.9Update to 8.3.10 | CVE-2024-8918 | |
| High7.5 | Unauthenticated Backup File Download and Upload ≤8.3.9Update to 8.3.10 | CVE-2024-8746 | |
| High8.8 | Cross-Site Request Forgery to Arbitrary File Upload ≤8.3.9Update to 8.3.10 | CVE-2024-8507 | |
| High8.8 | Authenticated (Subscriber+) Arbitrary File Upload ≤8.3.7Update to 8.3.8 | CVE-2024-7559 | |
| Critical9.9 | Directory Traversal ≤7.2.1Update to 7.2.2 | CVE-2023-6825 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤8.3.4Update to 8.3.5 | CVE-2023-7015 | |
| High8.8 | Authenticated (Subscriber+) Arbitrary File Upload ≤8.3.4Update to 8.3.5 | CVE-2023-6846 |
- Medium6.5Directory Traversal to Arbitrary File Deletion
≤1.8.9Update to 1.9
- High7.4Unauthenticated Limited JavaScript File Upload
≤8.3.9Update to 8.3.10
- High7.5Unauthenticated Backup File Download and Upload
≤8.3.9Update to 8.3.10
- High8.8Cross-Site Request Forgery to Arbitrary File Upload
≤8.3.9Update to 8.3.10
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
≤8.3.7Update to 8.3.8
- Critical9.9Directory Traversal
≤7.2.1Update to 7.2.2
- Medium6.1Reflected Cross-Site Scripting
≤8.3.4Update to 8.3.5
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
≤8.3.4Update to 8.3.5
File Manager Pro: common questions
Does File Manager Pro have known vulnerabilities?
Yes. VulnCrest Radar lists 8 known vulnerabilities in File Manager Pro: 1 critical, 5 high, 2 medium. None are known to affect version null.
How do I check which version of File Manager Pro I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent File Manager Pro vulnerability?
CVE-2025-0818, published Aug 12, 2025: Multiple elFinder Plugins <= (Various Versions) - Directory Traversal to Arbitrary File Deletion. Severity: Medium (CVSS 6.5).
Is any File Manager Pro vulnerability listed in CISA KEV?
No. None of the known File Manager Pro vulnerabilities is currently listed in the CISA KEV catalog.