File Manager Pro vulnerabilities

16 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 2 published in the last 12 months.

Exploited File Manager Pro vulnerabilities

CVE-2020-25213 — WordPress File Manager Plugin Remote Code Execution Vulnerability

CVE-2025-0818 — Multiple elFinder Plugins <= (Various Versions) - Directory Traversal to Arbitrary File Deletion (CVSS 6.5)
CVE-2024-37254 — WordPress WP File Manager plugin <= 7.2.7 - Broken Access Control vulnerability (CVSS 4.3)
CVE-2024-8918 — File Manager Pro <= 8.3.9 - Unauthenticated Limited JavaScript File Upload (CVSS 5.4)
CVE-2024-8746 — File Manager Pro <= 8.3.9 - Unauthenticated Backup File Download and Upload (CVSS 8.8)
CVE-2024-8507 — File Manager Pro <= 8.3.9 - Cross-Site Request Forgery to Arbitrary File Upload (CVSS 8.8)
CVE-2018-25105 — File Manager <= 3.0 - Unauthenticated Arbitrary File Upload/Download (CVSS 9.8)
CVE-2024-2654 — File Manager <= 7.2.5 - Authenticated (Administrator+) Directory Traversal (CVSS 6.8)
CVE-2024-1538 — File Manager <= 7.2.4 - Cross-Site Request Forgery to Local JS File Inclusion (CVSS 8.8)
CVE-2024-0761 — File Manager <= 7.2.1 - Sensitive Information Exposure via Backup Filenames (CVSS 7.5)
CVE-2023-6846 — File Manager Pro <= 8.3.4 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8)
CVE-2021-24177 — WP File Manager < 7.1 - Reflected Cross-Site Scripting (XSS) (CVSS 5.4)
CVE-2020-25213 — WordPress File Manager Plugin Remote Code Execution Vulnerability (CVSS 9.8) — exploited
CVE-2020-24312 — (CVSS 7.5)
CVE-2018-16967 — (CVSS 6.1)
CVE-2018-16966 — (CVSS 8.8)
CVE-2018-16363 — (CVSS 5.4)