Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-06-22
CVE-2026-11912 - Simple File List Plugin
The Simple File List plugin for WordPress is vulnerable to arbitrary file modification due to insufficient authorization checks in all versions up to, and including, 6.3.7. This makes it possible for unauthenticated attackers to delete and modify files on the serve. This vulnerability is exploitable even when the administrator has not enabled the AllowFrontManage setting, because the is_admin() check unconditionally short-circuits the guard before that setting is evaluated.
PLUGIN
Simple File List
CVE-2026-11912
Risk Score
Threat Entry
Updated 2026-06-22
CVE-2026-12119 - Simple File List Plugin
The Simple File List plugin for WordPress is vulnerable to unauthorized file operations due to a missing authorization check on the 'frontmanage' shortcode attribute in all versions up to, and including, 6.3.7. This makes it possible for authenticated attackers, with contributor-level access and above, to perform arbitrary file operations including deletion, move, folder creation, and download. An attacker can create a draft post containing the 'eeSFL' shortcode, render it via the post preview endpoint to harvest the nonce needed to authorize the operations, and then submit file operation requests that…
PLUGIN
Simple File List
CVE-2026-12119
Risk Score
Threat Entry
Updated 2026-06-22
CVE-2026-11911 - Simple File List Plugin
The Simple File List plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the eeSFL_DeleteFile function in all versions up to, and including, 6.3.7. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The simplefilelist_edit_job AJAX action is registered via wp_ajax_nopriv_, making it accessible without authentication, and the is_admin() guard that would otherwise restrict access is bypassed because is_admin() always returns…
PLUGIN
Simple File List
CVE-2026-11911
Risk Score
Threat Entry
Updated 2025-05-15
CVE-2024-10146 - Simple File List Plugin
The Simple File List WordPress plugin before 6.1.13 does not sanitise and escape a generated URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against admins.
PLUGIN
Simple File List
CVE-2024-10146
Risk Score
Threat Entry
Updated 2025-02-26
CVE-2023-1025 - Simple File List Plugin
The Simple File List WordPress plugin before 6.0.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Simple File List
CVE-2023-1025
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-3208 - Simple File List Plugin
The Simple File List WordPress plugin before 4.4.12 does not implement nonce checks, which could allow attackers to make a logged in admin create new page and change it's content via a CSRF attack.
PLUGIN
Simple File List
CVE-2022-3208
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-3207 - Simple File List Plugin
The Simple File List WordPress plugin before 4.4.12 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Simple File List
CVE-2022-3207
Risk Score
Threat Entry
Updated 2025-05-22
CVE-2022-3062 - Simple File List Plugin
The Simple File List WordPress plugin before 4.4.12 does not escape parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting
PLUGIN
Simple File List
CVE-2022-3062
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1119 - Simple File List Plugin
The Simple File List WordPress plugin is vulnerable to Arbitrary File Download via the eeFile parameter found in the ~/includes/ee-downloader.php file due to missing controls which makes it possible unauthenticated attackers to supply a path to a file that will subsequently be downloaded, in versions up to and including 3.2.7.
PLUGIN
Simple File List
CVE-2022-1119
Risk Score