Simplefilelist
Simplefilelist Simple File List: vulnerabilities and CVEs
Simplefilelist Simple File List has 15 published vulnerabilities, 8 of them in the last 12 months. 1 are rated critical and 0 are listed by CISA as actively exploited.
CVEs15
Last 12 months8
Critical1
Actively exploited0
All vulnerabilities in the catalogue →⭐ Follow this technology
Latest vulnerabilities
| CVE | Severity | EPSS | Active exploitation | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-16617 | High (8.8) | 0.51% | — | Aug 19, 2026 | The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users (when front-end file… |
| CVE-2026-16616 | High (8.6) | 0.73% | — | Aug 19, 2026 | The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate… |
| CVE-2026-57382 | High (7.1) | 0.25% | — | Jul 13, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mitchell Bennis Simple File List simple-file-list allows Reflected XSS.This issue affects Simple File List: from n/a… |
| CVE-2026-12119 | Medium (6.5) | 0.47% | — | Jun 20, 2026 | The Simple File List plugin for WordPress is vulnerable to unauthorized file operations due to a missing authorization check on the 'frontmanage' shortcode attribute in all versions up to, and including, 6.3.7. This… |
| CVE-2026-11912 | High (7.5) | 0.52% | — | Jun 20, 2026 | The Simple File List plugin for WordPress is vulnerable to arbitrary file modification due to insufficient authorization checks in all versions up to, and including, 6.3.7. This makes it possible for unauthenticated… |
| CVE-2026-11911 | High (7.5) | 1.2% | — | Jun 20, 2026 | The Simple File List plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the eeSFL_DeleteFile function in all versions up to, and including, 6.3.7. This makes it… |
| CVE-2026-24953 | Medium (6.5) | 0.39% | — | Feb 20, 2026 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mitchell Bennis Simple File List simple-file-list allows Path Traversal.This issue affects Simple File List: from n/a… |
| CVE-2025-68591 | Medium (5.4) | 0.25% | — | Dec 24, 2025 | Missing Authorization vulnerability in Mitchell Bennis Simple File List simple-file-list allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple File List: from n/a through <=… |
| CVE-2025-54021 | High (7.5) | 0.41% | — | Aug 20, 2025 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mitchell Bennis Simple File List simple-file-list allows Path Traversal.This issue affects Simple File List: from n/a… |
| CVE-2020-36847 | Critical (9.8) | 44% | — | Jul 12, 2025 | The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a png extension to use… |
| CVE-2025-47450 | Medium (5.3) | 0.32% | — | May 7, 2025 | Missing Authorization vulnerability in Mitchell Bennis Simple File List simple-file-list allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple File List: from n/a through <=… |
| CVE-2024-10146 | Medium (5.4) | 0.58% | — | Nov 14, 2024 | The Simple File List WordPress plugin before 6.1.13 does not sanitise and escape a generated URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against admins. |
| CVE-2023-44227 | High (7.5) | 0.56% | — | Apr 17, 2024 | Missing Authorization vulnerability in Mitchell Bennis Simple File List.This issue affects Simple File List: from n/a through 6.1.9. |
| CVE-2023-39924 | Medium (4.8) | 0.39% | — | Oct 25, 2023 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mitchell Bennis Simple File List plugin <= 6.1.9 versions. |
| CVE-2023-1025 | Medium (4.8) | 0.44% | — | Mar 27, 2023 | The Simple File List WordPress plugin before 6.0.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the… |