What’s Vulnerable › Products

Mitchell Bennis Simple File List vulnerabilities

14 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 11 published in the last 12 months.

Check whether your Mitchell Bennis Simple File List version is affected

Latest Mitchell Bennis Simple File List vulnerabilities

• CVE-2026-39792 — WordPress Simple File List plugin <= 6.3.11 - Arbitrary File Deletion vulnerability (CVSS 8.6)
• CVE-2026-57382 — WordPress Simple File List plugin <= 6.3.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
• CVE-2026-12119 — Simple File List <= 6.3.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Operations (Deletion / Move / Folder Creation / Download) via 'frontmanage' Shortcode Attribute (CVSS 6.5)
• CVE-2026-11912 — Simple File List <= 6.3.7 - Missing Authorization to Unauthenticated File Modification via simplefilelist_edit_job AJAX Action (CVSS 7.5)
• CVE-2026-11911 — Simple File List <= 6.3.7 - Unauthenticated Arbitrary File Deletion via Path Traversal in 'eeSubFolder' Parameter (CVSS 7.5)
• CVE-2026-24953 — WordPress Simple File List plugin <= 6.1.15 - Arbitrary File Download vulnerability (CVSS 6.5)
• CVE-2025-68591 — WordPress Simple File List plugin <= 6.1.18 - Broken Access Control vulnerability (CVSS 5.4)
• CVE-2025-54021 — WordPress Simple File List plugin <= 6.1.14 - Arbitrary File Download vulnerability (CVSS 7.5)
• CVE-2020-36847 — Simple File List < 4.2.3 - Remote Code Execution (CVSS 9.8)
• CVE-2025-47450 — WordPress Simple File List plugin <= 6.1.13 - Settings Change Vulnerability (CVSS 5.3)
• CVE-2024-10146 — Simple File List < 6.1.13 - Reflected Cross-Site Scripting (CVSS 5.4)
• CVE-2023-44227 — WordPress Simple File List Plugin <= 6.1.9 is vulnerable to Arbitrary File Deletion (CVSS 7.5)
• CVE-2023-39924 — WordPress Simple File List Plugin <= 6.1.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 4.8)
• CVE-2023-1025 — Simple File List < 6.0.10 - Admin+ Stored XSS (CVSS 4.8)