Get Simple is a lightweight, open-source content management system designed for small websites and blogs, with a vulnerability footprint concentrated in its core CMS product. The vendor's disclosures, while modest in volume relative to enterprise platforms, reflect the attack surface inherent to a web-facing application that processes user input and manages administrative authentication. Defenders deploying this CMS should treat it as a self-managed open-source project where patches may depend on community contribution and update cycles may be less formal than commercial platforms; live severity, exploitation, and current CVE counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Get Simple over time
Signals from CVEs in this vendor scope (48 CVEs).
48 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-11231CRITICAL An issue was discovered in GetSimple CMS through 3.3.15. insufficient input sanitation in the theme-edit.php file allows upload of files with arbitrary content (PHP code, for examp | May 22, 2019 | 9.8 | 84 | NO | YES |
CVE-2022-41544CRITICAL GetSimple CMS v3.3.16 was discovered to contain a remote code execution (RCE) vulnerability via the edited_file parameter in admin/theme-edit.php. | Oct 18, 2022 | 9.8 | 47 | NO | YES |
CVE-2013-10032HIGH An authenticated remote code execution vulnerability exists in GetSimpleCMS version 3.2.1. The application’s upload.php endpoint allows authenticated users to upload arbitrary file | Jul 25, 2025 | 8.8 | 43 | NO | YES |
CVE-2023-46042CRITICAL An issue in GetSimpleCMS v.3.4.0a allows a remote attacker to execute arbitrary code via a crafted payload to the phpinfo(). | Oct 19, 2023 | 9.8 | 37 | NO | NO |
CVE-2014-8722HIGH GetSimple CMS 3.3.4 allows remote attackers to obtain sensitive information via a direct request to (1) data/users/<username>.xml, (2) backups/users/<username>.xml.bak, (3) data/ot | Mar 17, 2017 | 7.5 | 35 | NO | YES |
CVE-2021-28976HIGH Remote Code Execution vulnerability in GetSimpleCMS before 3.3.16 in admin/upload.php via phar filess. | Jun 23, 2021 | 7.2 | 34 | NO | YES |
CVE-2019-9915MEDIUM GetSimpleCMS 3.3.13 has an Open Redirect via the admin/index.php redirect parameter. | Mar 22, 2019 | 6.1 | 32 | NO | YES |
CVE-2018-9173MEDIUM Cross-site scripting (XSS) vulnerability in admin/template/js/uploadify/uploadify.swf in GetSimple CMS 3.3.13 allows remote attackers to inject arbitrary web script or HTML, as dem | Apr 2, 2018 | 6.1 | 32 | NO | YES |
CVE-2020-23839MEDIUM A Reflected Cross-Site Scripting (XSS) vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webpage, allows remote attackers to execute JavaScript code in th | Sep 1, 2020 | 6.1 | 29 | NO | YES |
CVE-2021-47778HIGH GetSimple CMS My SMTP Contact Plugin 1.1.2 contains a PHP code injection vulnerability. An authenticated administrator can inject arbitrary PHP code through plugin configuration pa | Jan 21, 2026 | 7.2 | 27 | NO | NO |
Signals from CVEs in this vendor scope (48 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Get Simple.
Media articles that mention a CVE ID that affects a product developed by Get Simple — matched by CVE ID, not by vendor name.