Simple File List
Vendor:
First CVE: May 13, 2020 · Active for 6 years
9
Total CVEs
More Total CVEs than 86% of tracked products
1.8
Avg CVEs / Year
Higher CVE frequency than 60% of tracked products
6.6
Avg CVSS
Higher Avg CVSS than 33% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Simple File List over time
Volume of CVEsAvg CVSS Base Score
First CVE
May 13, 2020
6 years ago
Most Recent CVE
Jul 12, 2025
378 days ago
CVE Severity & Scoring
Simple File List9 CVEs
67%
11%
22%
All CVEs352,708 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network9 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low9 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None3 (33.3%)
Unknown0 (0.0%)
Required6 (66.7%)
Privileges Required
Low1 (11.1%)
High3 (33.3%)
None5 (55.6%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (9 CVEs).
9 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-36847CRITICAL The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploade | Jul 12, 2025 | 9.8 | 59 | NO | YES |
CVE-2022-3062MEDIUM The Simple File List WordPress plugin before 4.4.12 does not escape parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting | Sep 26, 2022 | 6.1 | 57 | NO | YES |
CVE-2020-12832CRITICAL WordPress Plugin Simple File List before 4.2.8 is prone to a vulnerability that lets attackers delete arbitrary files because the application fails to properly verify user-supplied | May 13, 2020 | 9.8 | 44 | NO | YES |
CVE-2022-1119HIGH The Simple File List WordPress plugin is vulnerable to Arbitrary File Download via the eeFile parameter found in the ~/includes/ee-downloader.php file due to missing controls which | Apr 19, 2022 | 7.5 | 40 | NO | YES |
CVE-2024-10146MEDIUM The Simple File List WordPress plugin before 6.1.13 does not sanitise and escape a generated URL before outputting it back in an attribute, leading to a Reflected Cross-Site Script | Nov 14, 2024 | 5.4 | 26 | NO | YES |
CVE-2022-3208MEDIUM The Simple File List WordPress plugin before 4.4.12 does not implement nonce checks, which could allow attackers to make a logged in admin create new page and change it's content v | Oct 10, 2022 | 6.5 | 23 | NO | NO |
CVE-2022-3207MEDIUM The Simple File List WordPress plugin before 4.4.12 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross- | Oct 10, 2022 | 4.8 | 19 | NO | NO |
CVE-2023-39924MEDIUM Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mitchell Bennis Simple File List plugin <= 6.1.9 versions. | Oct 25, 2023 | 4.8 | 16 | NO | NO |
CVE-2023-1025MEDIUM The Simple File List WordPress plugin before 6.0.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross- | Mar 27, 2023 | 4.8 | 15 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (9 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
1 CVE
11.1% of CVEs· 97th percentile
Nuclei
4 CVEs
44.4% of CVEs· 98th percentile
ExploitDB
1 CVE
11.1% of CVEs· 89th percentile
Social Chatter
Signals from CVEs in this product scope (9 CVEs).
Media Mentions
Signals from CVEs in this product scope (9 CVEs).
Top CNAs Publishing CVEs For Simple File List
Top CWEs
Versions
No cataloged versions.