SEGURIDAD DE PLUGINS
Vulnerabilidades conocidas, compatibilidad con PHP y alternativas más seguras para el plugin de WordPress Simple File List — verificado contra la base de datos de seguridad local de WP Clinic.
simple-file-listdocument libraryfile managerfile sharingftp alternativeshare documents
18 CVEs conocidos registrados para Simple File List. Reportadas entre 2019 y 2026.
| CVE | Vulnerabilidad | Tipo | Gravedad | Afectadas | Corregido en | Publicado | Estado |
|---|---|---|---|---|---|---|---|
| CVE-2026-57382 | Simple File List [simple-file-list] < 6.3.9 | — | Alta 7,1 | < 6.3.9 | 6.3.9 | 2026-07-07 | ✓ corregido en la última versión |
| CVE-2026-12119 | Simple File List [simple-file-list] < 6.3.8 | Falta de control de autorización | Media 6,5 | < 6.3.8 | 6.3.8 | 2026-06-19 | ✓ corregido en la última versión |
| CVE-2026-11911 | Simple File List [simple-file-list] < 6.3.8 | Limitación incorrecta de una ruta a un directorio restringido (Path Traversal) | Alta 7,5 | < 6.3.8 | 6.3.8 | 2026-06-19 | ✓ corregido en la última versión |
| CVE-2026-11912 | Simple File List [simple-file-list] < 6.3.8 | Falta de control de autorización | Alta 7,5 | < 6.3.8 | 6.3.8 | 2026-06-19 | ✓ corregido en la última versión |
| CVE-2026-24953 | Simple File List [simple-file-list] < 6.1.16 | Limitación incorrecta de una ruta a un directorio restringido (Path Traversal) | Media 6,5 | < 6.1.16 | 6.1.16 | 2026-02-09 | ✓ corregido en la última versión |
| — | Simple File List [simple-file-list] <= 6.1.18 (unfixed) | Falta de control de autorización | Media 5,4 | < 6.1.18 | 6.1.18 | 2025-12-24 | ✓ corregido en la última versión |
| CVE-2025-54021 | Simple File List [simple-file-list] < 6.1.15 | Limitación incorrecta de una ruta a un directorio restringido (Path Traversal) | Alta 7,5 | < 6.1.15 | 6.1.15 | 2025-07-28 | ✓ corregido en la última versión |
| CVE-2020-36847 | Simple File List [simple-file-list] < 4.2.3 | Carga de archivos sin restricción de tipo peligroso | Crítica 9,8 | < 4.2.3 | 4.2.3 | 2025-07-12 | ✓ corregido en la última versión |
The Simple File List plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 6.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Simple File List plugin for WordPress is vulnerable to unauthorized file operations due to a missing authorization check on the 'frontmanage' shortcode attribute in all versions up to, and including, 6.3.7. This makes it possible for authenticated attackers, with contributor-level access and above, to perform arbitrary file operations including deletion, move, folder creation, and download. An attacker can create a draft post containing the 'eeSFL' shortcode, render it via the post preview endpoint to harvest the nonce needed to authorize the operations, and then submit file operation requests that bypass the intended authorization checks in includes/ee-list-ops-bar-process.php.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The Simple File List plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the eeSFL_DeleteFile function in all versions up to, and including, 6.3.7. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The simplefilelist_edit_job AJAX action is registered via wp_ajax_nopriv_, making it accessible without authentication, and the is_admin() guard that would otherwise restrict access is bypassed because is_admin() always returns true for requests to the admin-ajax.php endpoint.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The Simple File List plugin for WordPress is vulnerable to arbitrary file modification due to insufficient authorization checks in all versions up to, and including, 6.3.7. This makes it possible for unauthenticated attackers to delete and modify files on the serve. This vulnerability is exploitable even when the administrator has not enabled the AllowFrontManage setting, because the is_admin() check unconditionally short-circuits the guard before that setting is evaluated.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The Simple File List plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 6.1.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Simple File List plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 6.3.7. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Simple File List plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.1.14. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a png extension to use a php extension. This allows unauthenticated attackers to execute code on the server.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
| CVE | Vulnerabilidad | Tipo | Gravedad | Afectadas | Corregido en | Publicado | Estado |
|---|---|---|---|---|---|---|---|
| CVE-2025-34085 | Simple File List [simple-file-list] < 4.2.3 | Falta de autenticación en una función crítica | Desconocido | < 4.2.3 | 4.2.3 | 2025-07-09 | ✓ corregido en la última versión |
| CVE-2025-47450 | Simple File List [simple-file-list] < 6.1.14 | Falta de control de autorización | Media 5,3 | < 6.1.14 | 6.1.14 | 2025-05-07 | ✓ corregido en la última versión |
| CVE-2024-10146 | Simple File List [simple-file-list] < 6.1.13 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 6.1.13 | 6.1.13 | 2024-10-24 | ✓ corregido en la última versión |
| CVE-2023-39924 | Simple File List [simple-file-list] < 6.1.10 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,9 | < 6.1.10 | 6.1.10 | 2023-10-12 | ✓ corregido en la última versión |
| CVE-2023-44227 | Simple File List [simple-file-list] < 6.1.10 | Falta de control de autorización | Alta 7,5 | < 6.1.10 | 6.1.10 | 2023-09-28 | ✓ corregido en la última versión |
| CVE-2023-1025 | Simple File List [simple-file-list] < 6.0.10 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 4,8 | < 6.0.10 | 6.0.10 | 2023-02-28 | ✓ corregido en la última versión |
| CVE-2022-3208 | Simple File List [simple-file-list] < 4.4.13 | Falsificación de petición en sitios cruzados (CSRF) | Media 6,5 | < 4.4.13 | 4.4.13 | 2022-09-19 | ✓ corregido en la última versión |
| CVE-2022-3207 | Simple File List [simple-file-list] < 4.4.12 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 4,8 | < 4.4.12 | 4.4.12 | 2022-09-19 | ✓ corregido en la última versión |
| CVE-2022-3062 | Simple File List [simple-file-list] < 4.4.12 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,1 | < 4.4.12 | 4.4.12 | 2022-08-26 | ✓ corregido en la última versión |
| — | Simple File List [simple-file-list] < 4.2.3 | — | Desconocido | < 4.2.3 | 4.2.3 | 2020-11-02 | ✓ corregido en la última versión |
| CVE-2020-12832 | Simple File List [simple-file-list] < 4.2.8 | Limitación incorrecta de una ruta a un directorio restringido (Path Traversal) | Crítica 9,8 | < 4.2.8 | 4.2.8 | 2020-05-13 | ✓ corregido en la última versión |
| — | Simple File List [simple-file-list] < 4.2.3 | — | Desconocido | < 4.2.3 | 4.2.3 | 2020-04-27 | ✓ corregido en la última versión |
| — | Simple File List [simple-file-list] < 3.2.5 | — | Desconocido | < 3.2.5 | 3.2.5 | 2019-05-27 | ✓ corregido en la última versión |
| — | Simple File List [simple-file-list] < 3.2.5 | — | Desconocido | < 3.2.5 | 3.2.5 | 2019-05-27 | ✓ corregido en la última versión |
| CVE-2022-1119 | Simple File List [simple-file-list] < 3.2.8 | Limitación incorrecta de una ruta a un directorio restringido (Path Traversal) | Alta 7,5 | < 3.2.8 | 3.2.8 | 2019-05-23 | ✓ corregido en la última versión |
| — | Simple File List [simple-file-list] < 3.2.5 | — | Desconocido | < 3.2.5 | 3.2.5 | 2019-05-23 | ✓ corregido en la última versión |
| — | Simple File List [simple-file-list] < 4.2.3 | — | Desconocido | < 4.2.3 | 4.2.3 | — | ✓ corregido en la última versión |
| — | Simple File List [simple-file-list] < 3.2.5 | — | Desconocido | < 3.2.5 | 3.2.5 | — | ✓ corregido en la última versión |
| — | Simple File List [simple-file-list] < 3.2.8 | — | Desconocido | < 3.2.8 | 3.2.8 | — | ✓ corregido en la última versión |
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it is a duplicate of CVE-2020-36847.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: euvd.enisa.europa.eu
The Simple File List plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the eeSFL_BASE_Setup() function in all versions up to, and including, 6.1.13. This makes it possible for unauthenticated attackers to set the eeSFL_Lang option to en_US
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Simple File List plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via a URL in all versions up to, and including, 6.1.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Simple File List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in versions up to, and including, 6.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only impacts multi-site installations and installations where unfiltered_html has been disabled.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Simple File List plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and including, 6.1.9. This is due to insufficient controls on files passed to a deletion function. This makes it possible for unauthenticated attackers to delete arbitrary files, which can lead to a denial of service or remote code execution when the wp-config.php file is deleted.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Simple File List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 6.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Simple File List plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.4.12. This is due to missing or incorrect nonce validation on its page creation function eeSFL_FREE_CreatePostwithShortcode(). This makes it possible for unauthenticated attackers to create new pages and manipulate their contents, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Simple File List plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' and 'subtab' parameters in versions up to, and including, 4.4.11 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Simple File List plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ and 'subtab' parameters in versions up to, and including, 4.4.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a png extension to use a php extension. This allows unauthenticated attackers to execute code on the server.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
WordPress Plugin Simple File List before 4.2.8 is prone to a vulnerability that lets attackers delete arbitrary files because the application fails to properly verify user-supplied input.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
Unauthenticated Arbitrary File Upload vulnerability leading to Remote Code Execution (RCE) discovered by h00die and coiffeur in WordPress Simple File List plugin (versions <= 4.2.2).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
Unauthenticated Arbitrary File Download vulnerability found by Admavidhya N in WordPress Simple File List plugin (versions <= 3.2.4).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
Authenticated Arbitrary File Delete vulnerability found by Admavidhya N in WordPress Simple File List plugin (versions <= 3.2.4).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
The Simple File List WordPress plugin is vulnerable to Arbitrary File Download via the eeFile parameter found in the ~/includes/ee-downloader.php file due to missing controls which makes it possible unauthenticated attackers to supply a path to a file that will subsequently be downloaded, in versions up to and including 3.2.7.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The Simple File List plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 3.2.4. This is due to the upward path traversal via the 'eeDeleteFile' parameter. This makes it possible for unauthenticated attackers to delete files within the vulnerable service.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Simple File List WordPress plugin was found to be vulnerable to an unauthenticated arbitrary file upload leading to remote code execution. The Python exploit first uploads a file containing PHP code but with a png image file extension. A second request is sent to move (rename) the png file to a php file.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: WPScan
Arbitrary File Delete exist in Simple File List Plugin v 3.2.4 or below Authentication Required: Yes
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: WPScan
This vulnerability allows any user to download sensitive information by traversing the path Authentication required: NO
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: WPScan
Mantén Simple File List actualizado — 6.3.11 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").
Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.
Ejecuta un escaneo pasivo gratis ahora, o crea una cuenta gratuita e instala el plugin de WP Clinic para un escaneo profundo de toda tu cuenta de hosting y reparación asistida por IA.