Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · simple-file-list
Simple File List
21 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 6, 2026Unauthenticated Arbitrary File Deletion in Simple File List <= 6.3.11 versions.CVE-2026-39792 · affects up to 6.3.11 · reported by PatchstackHigh 8.6
Unauthenticated Arbitrary File Deletion in Simple File List <= 6.3.11 versions.
Aug 19, 2026Simple File List: Does not properly sanitise and escape a file's description before outputting it on the public file listCVE-2026-16617 · affects up to 6.3.11 · reported by WPScanHigh 8.8
The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users (when front-end file management is enabled) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the list.
Aug 19, 2026Simple File List: Does not validate the source path of a file-move operation reachable by unauthenticated usersCVE-2026-16616 · affects up to 6.3.11 · reported by WPScanHigh 8.6
The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure and potential site takeover.
Jul 13, 2026Simple File List: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57382 · affects up to 6.3.8 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mitchell Bennis Simple File List simple-file-list allows Reflected XSS.This issue affects Simple File List: from n/a through <= 6.3.8.
Jun 20, 2026Simple File List: Unauthorized file operationsCVE-2026-12119 · affects up to 6.3.7 · reported by WordfenceMedium 6.5
The Simple File List plugin for WordPress is vulnerable to unauthorized file operations due to a missing authorization check on the 'frontmanage' shortcode attribute in all versions up to, and including, 6.3.7. This makes it possible for authenticated attackers, with contributor-level access and above, to perform arbitrary file operations including deletion, move, folder creation, and download. An attacker can create a draft post containing the 'eeSFL' shortcode, render it via the post preview endpoint to harvest the nonce needed to authorize the operations, and then submit file operation requests that bypass the intended authorization checks in includes/ee-list-ops-bar-process.php.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 20, 2026Simple File List: Arbitrary file modificationCVE-2026-11912 · affects up to 6.3.7 · reported by WordfenceHigh 7.5
The Simple File List plugin for WordPress is vulnerable to arbitrary file modification due to insufficient authorization checks in all versions up to, and including, 6.3.7. This makes it possible for unauthenticated attackers to delete and modify files on the serve. This vulnerability is exploitable even when the administrator has not enabled the AllowFrontManage setting, because the is_admin() check unconditionally short-circuits the guard before that setting is evaluated.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 20, 2026Simple File List: Arbitrary file deletionCVE-2026-11911 · affects up to 6.3.7 · reported by WordfenceHigh 7.5
The Simple File List plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the eeSFL_DeleteFile function in all versions up to, and including, 6.3.7. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The simplefilelist_edit_job AJAX action is registered via wp_ajax_nopriv_, making it accessible without authentication, and the is_admin() guard that would otherwise restrict access is bypassed because is_admin() always returns true for requests to the admin-ajax.php endpoint.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 20, 2026Simple File List: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-24953 · affects up to 6.1.15 · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mitchell Bennis Simple File List simple-file-list allows Path Traversal.This issue affects Simple File List: from n/a through <= 6.1.15.
Dec 24, 2025Simple File List: Missing AuthorizationCVE-2025-68591 · affects up to 6.1.18 · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Mitchell Bennis Simple File List simple-file-list allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple File List: from n/a through <= 6.1.18.
Aug 20, 2025Simple File List: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-54021 · affects up to 6.1.14 · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mitchell Bennis Simple File List simple-file-list allows Path Traversal.This issue affects Simple File List: from n/a through <= 6.1.14.
Jul 12, 2025Simple-File-List: Remote Code ExecutionCVE-2020-36847 · affects up to 4.2.2 · reported by WordfenceCritical 9.8
The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a png extension to use a php extension. This allows unauthenticated attackers to execute code on the server.
May 7, 2025Simple File List: Missing AuthorizationCVE-2025-47450 · affects up to 6.1.13 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Mitchell Bennis Simple File List simple-file-list allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple File List: from n/a through <= 6.1.13.
Nov 14, 2024Simple File List: Does not sanitise and escape a generated URL before outputting it back in an attributeCVE-2024-10146 · fixed in 6.1.13 · reported by WPScanMedium 5.4
The Simple File List WordPress plugin before 6.1.13 does not sanitise and escape a generated URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against admins.
Apr 17, 2024Simple File List: Missing AuthorizationCVE-2023-44227 · affects up to 6.1.9 · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Mitchell Bennis Simple File List.This issue affects Simple File List: from n/a through 6.1.9.
Oct 25, 2023Auth.CVE-2023-39924 · affects up to 6.1.9 · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mitchell Bennis Simple File List plugin <= 6.1.9 versions.
Mar 27, 2023Simple File List: Does not sanitise and escape some of its settingsCVE-2023-1025 · fixed in 6.0.10 · reported by WPScanMedium 4.8
The Simple File List WordPress plugin before 6.0.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Oct 10, 2022Simple File List: Does not implement nonce checksCVE-2022-3208 · fixed in 4.4.12 · reported by WPScanMedium 6.5
The Simple File List WordPress plugin before 4.4.12 does not implement nonce checks, which could allow attackers to make a logged in admin create new page and change it's content via a CSRF attack.
Oct 10, 2022Simple File List: Does not sanitise and escape some of its settingsCVE-2022-3207 · fixed in 4.4.12 · reported by WPScanMedium 4.8
The Simple File List WordPress plugin before 4.4.12 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Sep 26, 2022Simple File List: Does not escape parameters before outputting them back in attributesCVE-2022-3062 · fixed in 4.4.12 · reported by WPScanMedium 6.1
The Simple File List WordPress plugin before 4.4.12 does not escape parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting
Apr 19, 2022Simple File List: Arbitrary File DownloadCVE-2022-1119 · affects up to 3.2.7 · reported by WordfenceHigh 7.5
The Simple File List WordPress plugin is vulnerable to Arbitrary File Download via the eeFile parameter found in the ~/includes/ee-downloader.php file due to missing controls which makes it possible unauthenticated attackers to supply a path to a file that will subsequently be downloaded, in versions up to and including 3.2.7.
May 13, 2020WordPress Plugin Simple File List before 4.2.8 is prone to a vulnerability that lets attackers delete arbitrary files because the application fails to properly CVE-2020-12832 · fixed in 4.2.8 · reported by MITRECritical 9.8
WordPress Plugin Simple File List before 4.2.8 is prone to a vulnerability that lets attackers delete arbitrary files because the application fails to properly verify user-supplied input.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.