HomeWordPress vulnerabilitiesSimple File List
Simple File List vulnerabilities
Simple File List has 12 known vulnerabilities in this database. The most recent published record is dated 6 Oct 2026.
- Known vulnerabilities
- 12
- Active installs
- Not listed
- Latest version
- Unknown
- Last updated
- Unknown
- Most recent
- 6 Oct 2026
This plugin is shown as closed on WordPress.org, so check the vulnerability record and the developer's current information before deciding whether to keep it installed. WordPress.org reason: security issue.
Find it in your WordPress dashboard under Plugins. Severity is based on the CVSS score published with the CVE where one is available.
| Vulnerability | Severity | Affected | Fix | Published |
|---|---|---|---|---|
| Arbitrary file deletion CVE-2026-39792 | High 8.6 | Up to 6.3.11 | No fix: plugin closed | 1 d ago |
| Broken access control CVE-2026-11912 | High 7.5 | Up to 6.3.7 | No fix: plugin closed | 20 Jun 2026 |
| Broken access control CVE-2026-12119 | Medium 6.5 | Up to 6.3.7 | No fix: plugin closed | 20 Jun 2026 |
| Remote code execution CVE-2026-11911 | High 7.5 | Up to 6.3.7 | No fix: plugin closed | 20 Jun 2026 |
| Remote code execution CVE-2020-36847 | Critical 9.8 | Before 4.2.3 | Fixed in 4.2.3 | 12 Jul 2025 |
| Cross-site scripting (XSS) CVE-2024-10146 | Medium 5.4 | Before 6.1.13 | Fixed in 6.1.13 | 14 Nov 2024 |
| Cross-site scripting (XSS) CVE-2023-1025 | Medium 4.8 | Before 6.0.10 | Fixed in 6.0.10 | 27 Mar 2023 |
| Cross-site scripting (XSS) CVE-2022-3207 | Medium 4.8 | Before 4.4.12 | Fixed in 4.4.12 | 10 Oct 2022 |
| Cross-site request forgery (CSRF) CVE-2022-3208 | Medium 6.5 | Before 4.4.12 | Fixed in 4.4.12 | 10 Oct 2022 |
| Cross-site scripting (XSS) CVE-2022-3062 | Medium 6.1 | Before 4.4.12 | Fixed in 4.4.12 | 26 Sep 2022 |
| Arbitrary file read CVE-2022-1119 | High 7.5 | Before 3.2.8 | Fixed in 3.2.8 | 19 Apr 2022 |
| Path traversal CVE-2020-12832 | Critical 9.8 | Before 4.2.8 | Fixed in 4.2.8 | 13 May 2020 |
Read the published descriptions
- CVE-2026-39792, 6 Oct 2026
- Unauthenticated Arbitrary File Deletion in Simple File List <= 6.3.11 versions. CVE record
- CVE-2026-11912, 20 Jun 2026
- The Simple File List plugin for WordPress is vulnerable to arbitrary file modification due to insufficient authorization checks in all versions up to, and including, 6.3.7. This makes it possible for unauthenticated attackers to delete and modify files on the serve. This vulnerability is exploitable even when the administrator has not enabled the AllowFrontManage setting, because the is_admin() check unconditionally short-circuits the guard before that setting is evaluated. CVE record
- CVE-2026-12119, 20 Jun 2026
- The Simple File List plugin for WordPress is vulnerable to unauthorized file operations due to a missing authorization check on the 'frontmanage' shortcode attribute in all versions up to, and including, 6.3.7. This makes it possible for authenticated attackers, with contributor-level access and above, to perform arbitrary file operations including deletion, move, folder creation, and download. An attacker can create a draft post containing the 'eeSFL' shortcode, render it via the post preview endpoint to harvest the nonce needed to authorize the operations, and then submit file operation requests that bypass the intended authorization checks in includes/ee-list-ops-bar-process.php. CVE record
- CVE-2026-11911, 20 Jun 2026
- The Simple File List plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the eeSFL_DeleteFile function in all versions up to, and including, 6.3.7. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The simplefilelist_edit_job AJAX action is registered via wp_ajax_nopriv_, making it accessible without authentication, and the is_admin() guard that would otherwise restrict access is bypassed because is_admin() always returns true for requests to the admin-ajax.php endpoint. CVE record
- CVE-2020-36847, 12 Jul 2025
- The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a png extension to use a php extension. This allows unauthenticated attackers to execute code on the server. CVE record
- CVE-2024-10146, 14 Nov 2024
- The Simple File List WordPress plugin before 6.1.13 does not sanitise and escape a generated URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against admins. CVE record
- CVE-2023-1025, 27 Mar 2023
- The Simple File List WordPress plugin before 6.0.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). CVE record
- CVE-2022-3207, 10 Oct 2022
- The Simple File List WordPress plugin before 4.4.12 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) CVE record
- CVE-2022-3208, 10 Oct 2022
- The Simple File List WordPress plugin before 4.4.12 does not implement nonce checks, which could allow attackers to make a logged in admin create new page and change it's content via a CSRF attack. CVE record
- CVE-2022-3062, 26 Sep 2022
- The Simple File List WordPress plugin before 4.4.12 does not escape parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting CVE record
- CVE-2022-1119, 19 Apr 2022
- The Simple File List WordPress plugin is vulnerable to Arbitrary File Download via the eeFile parameter found in the ~/includes/ee-downloader.php file due to missing controls which makes it possible unauthenticated attackers to supply a path to a file that will subsequently be downloaded, in versions up to and including 3.2.7. CVE record
- CVE-2020-12832, 13 May 2020
- WordPress Plugin Simple File List before 4.2.8 is prone to a vulnerability that lets attackers delete arbitrary files because the application fails to properly verify user-supplied input. CVE record
What to do if you run Simple File List
If you run Simple File List, open WordPress and check the installed version in Plugins. Compare it with the affected versions in the vulnerability record. If a fixed version is available, take a current backup and update to that version or the latest supported release.
If no fixed version exists, consider disabling and removing the plugin or replacing it with a maintained alternative. After dealing with the affected software, check administrator users, unexpected file changes, redirects, unfamiliar pages and security logs for signs that the site may already have been altered.
Email me about new Simple File List vulnerabilities
Free. We email you when a new vulnerability is published for Simple File List, usually within minutes. Confirm by email; unsubscribe any time.
Focus on your business. We’ll take care of your website.
From everyday updates to ongoing care, we keep your website working.