WordPress security by component
File Manager
Plugin description
File Manager is a WordPress component with 6 published CVE records in this archive. The latest tracked vulnerability was published Nov 01, 2024; the highest CVE/CNA score is 10.
Plugin slug:
wp-file-managerLatest vulnerability
CVE-2024-37254: File Manager: A security weakness
File Manager is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
| Safe version |
|
||
|---|---|---|---|
| Nov 01, 2024 |
CVE-2024-37254
File Manager: A security weakness
File Manager is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE4.3
NVDPending
|
| Apr 09, 2024 |
CVE-2024-2654
File Manager: Filesystem traversal
File Manager is affected by filesystem traversal. Exploitation requires an authenticated WordPress account. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE6.8
NVDPending
|
| Feb 05, 2024 |
CVE-2024-0761
File Manager: Sensitive information exposure
File Manager is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller.
|
See mitigation notes |
CVE8.1
NVD7.5
|
| Sep 09, 2020 |
CVE-2020-25213
Wp File Manager: A security weakness
Wp File Manager is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE10.0
NVD9.8
|
| Apr 15, 2019 |
CVE-2018-16967
Wp File Manager: Cross-site scripting
Wp File Manager is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.1
NVD6.1
|
| Apr 15, 2019 |
CVE-2018-16966
Wp File Manager: Cross-site request forgery
Wp File Manager is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE8.8
NVD8.8
|