WordPress plugin · simple-file-list
Is Simple File List safe?
Closed. Replace it.
wordpress.org closed it on Jul 23, 2026 (security issue), so it gets no more security fixes, and 21 flaws are on record. If your site runs it, move to a maintained alternative.
- Flaws on record
- 21
- High or critical
- 11
- Exploited
- none
Every recorded flaw
- Oct 6, 2026Unauthenticated Arbitrary File Deletion in Simple File List <= 6.3.11 versions.CVE-2026-39792 · affects up to 6.3.11 · reported by PatchstackHigh 8.6
- Aug 19, 2026Simple File List: Does not properly sanitise and escape a file's description before outputting it on the public file listCVE-2026-16617 · affects up to 6.3.11 · reported by WPScanHigh 8.8
- Aug 19, 2026Simple File List: Does not validate the source path of a file-move operation reachable by unauthenticated usersCVE-2026-16616 · affects up to 6.3.11 · reported by WPScanHigh 8.6
- Jul 13, 2026Simple File List: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57382 · affects up to 6.3.8 · reported by PatchstackHigh 7.1
- Jun 20, 2026Simple File List: Unauthorized file operationsCVE-2026-12119 · affects up to 6.3.7 · reported by WordfenceMedium 6.5
- Jun 20, 2026Simple File List: Arbitrary file modificationCVE-2026-11912 · affects up to 6.3.7 · reported by WordfenceHigh 7.5
- Jun 20, 2026Simple File List: Arbitrary file deletionCVE-2026-11911 · affects up to 6.3.7 · reported by Wordfence1.2% oddsHigh 7.5
- Feb 20, 2026Simple File List: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-24953 · affects up to 6.1.15 · reported by PatchstackMedium 6.5
- Dec 24, 2025Simple File List: Missing AuthorizationCVE-2025-68591 · affects up to 6.1.18 · reported by PatchstackMedium 5.4
- Aug 20, 2025Simple File List: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-54021 · affects up to 6.1.14 · reported by PatchstackHigh 7.5
- Jul 12, 2025Simple-File-List: Remote Code ExecutionCVE-2020-36847 · affects up to 4.2.2 · reported by Wordfence44% oddsCritical 9.8
- May 7, 2025Simple File List: Missing AuthorizationCVE-2025-47450 · affects up to 6.1.13 · reported by PatchstackMedium 5.3
- Nov 14, 2024Simple File List: Does not sanitise and escape a generated URL before outputting it back in an attributeCVE-2024-10146 · fixed in 6.1.13 · reported by WPScanMedium 5.4
- Apr 17, 2024Simple File List: Missing AuthorizationCVE-2023-44227 · affects up to 6.1.9 · reported by PatchstackHigh 7.5
- Oct 25, 2023Auth.CVE-2023-39924 · affects up to 6.1.9 · reported by PatchstackMedium 5.9
- Mar 27, 2023Simple File List: Does not sanitise and escape some of its settingsCVE-2023-1025 · fixed in 6.0.10 · reported by WPScanMedium 4.8
- Oct 10, 2022Simple File List: Does not implement nonce checksCVE-2022-3208 · fixed in 4.4.12 · reported by WPScanMedium 6.5
- Oct 10, 2022Simple File List: Does not sanitise and escape some of its settingsCVE-2022-3207 · fixed in 4.4.12 · reported by WPScanMedium 4.8
- Sep 26, 2022Simple File List: Does not escape parameters before outputting them back in attributesCVE-2022-3062 · fixed in 4.4.12 · reported by WPScan44% oddsMedium 6.1
- Apr 19, 2022Simple File List: Arbitrary File DownloadCVE-2022-1119 · affects up to 3.2.7 · reported by Wordfence20% oddsHigh 7.5
- May 13, 2020WordPress Plugin Simple File List before 4.2.8 is prone to a vulnerability that lets attackers delete arbitrary files because the application fails to properly CVE-2020-12832 · fixed in 4.2.8 · reported by MITRE7.1% oddsCritical 9.8
Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.