Plugin security history

Frontend File Manager Plugin Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 30 vulnerability records associated with Frontend File Manager Plugin, published between 2014 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

30Total records

5Critical

10High

15Medium

0Low

0Informational

24Patched records

6Currently marked unpatched

2014-09-25First disclosure

2026-06-27Latest disclosure

28 of 30CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2014	1	1 records
2015	1	1 records
2016	1	1 records
2021	8	8 records
2022	4	4 records
2023	1	1 records
2024	1	1 records
2025	6	6 records
2026	7	7 records

Severity Breakdown

Severity	Records	Share
Critical	5	16.7%
High	10	33.3%
Medium	15	50%

Vulnerability-Type Breakdown

Missing Authorization

18 records60%

First: 2021. Latest: 2026.

Arbitrary File Upload

4 records13.3%

First: 2014. Latest: 2022.

Path Traversal

3 records10%

First: 2023. Latest: 2026.

Cross-Site Scripting

2 records6.7%

First: 2021. Latest: 2026.

CSRF

2 records6.7%

First: 2022. Latest: 2022.

Information Disclosure

1 record3.3%

First: 2024. Latest: 2024.

Patch Status

Patched: 24
Currently marked unpatched: 6
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

23.6
23.5
23.3
23.4
22.0
22.8
22.6
21.3
21.4
18.3
4.0
3.8
3.6

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-23.6`	Frontend File Manager Plugin <= 23.6 - Authenticated (Subscriber+) Arbitrary File Deletion	June 27, 2026	Not supplied	High
`*-23.6`	Frontend File Manager Plugin <= 23.6 - Missing Authorization to Unauthenticated File Download	June 25, 2026	Not supplied	Medium
`*-23.6`	Frontend File Manager Plugin <= 23.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting	June 25, 2026	Not supplied	Medium
`*-23.6`	Frontend File Manager <= 23.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Download Access	April 11, 2026	Not supplied	Medium
`*-23.5`	Frontend File Manager <= 23.5 - Missing Authorization	February 17, 2026	Not supplied	Medium
`*-23.5`	Frontend File Manager Plugin <= 23.5 - Missing Authorization to Unauthenticated Arbitrary File Sharing via 'file_id' Parameter	January 27, 2026	23.6	High
`*-23.5`	Frontend File Manager Plugin <= 23.5 - Unauthenticated Insecure Direct Object Reference	January 16, 2026	23.6	Medium
`*-23.4`	Frontend File Manager <= 23.4 - Authenticated (Subscriber+) Arbitrary File Deletion	December 17, 2025	23.5	High
`*-23.4`	Frontend File Manager Plugin <= 23.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary File Renaming	November 24, 2025	23.5	Medium
`*-23.2`	Frontend File Manager <= 23.2 - Missing Authorization	October 30, 2025	23.3	Medium
`*-23.2`	Frontend File Manager <= 23.2 - Missing Authorization	September 22, 2025	23.4	Medium
`*-21.5`	Frontend File Manager <= 21.5 - Missing Authorization to Unauthenticated Arbitrary Post Deletion	July 24, 2025	22.0	High
`*-23.2`	Frontend File Manager <= 23.2 - Missing Authorization to Authenticated (Subscriber+) Content Injection	July 4, 2025	Not supplied	Medium
`*-22.7`	Frontend File Manager <= 22.7 - Sensitive Information Exposure via user uploads	February 12, 2024	22.8	Medium
`*-22.5`	Frontend File Manager Plugin <= 22.5 - Authenticated (Editor+) Directory Traversal	November 13, 2023	22.6	Critical
`*-21.2`	Frontend File Manager Plugin <= 21.2 - Cross-Site Request Forgery to File Upload	September 26, 2022	21.3	High
`*-21.2`	Frontend File Manager <= 21.2 - Missing Authorization	September 7, 2022	21.3	Medium
`*-21.2`	Frontend File Manager <= 21.2 - Authenticated (Subscriber+) Arbitrary File Upload	September 7, 2022	21.3	High
`*-21.3`	Frontend File Manager <= 21.3 - Cross-Site Request Forgery to Plugin Settings Update	September 6, 2022	21.4	High
`[*, 18.3)`	Frontend File Manager <= 18.2 - Unauthenticated Content Injection	July 12, 2021	18.3	Medium
`[*, 18.3)`	Frontend File Manager <= 18.2 - Authenticated Settings Change leading to Arbitrary File Upload	July 12, 2021	18.3	Critical
`[*, 18.3)`	Frontend File Manager <= 18.2 - Unauthenticated Stored Cross-Site Scripting	July 12, 2021	18.3	High
`[*, 18.3)`	Frontend File Manager Plugin <= 18.2 - Unauthenticated Arbitrary Post Deletion	July 12, 2021	18.3	Medium
`[*, 18.3)`	Frontend File Manager <= 18.2 - Unauthenticated Arbitrary File Download	July 12, 2021	18.3	Critical
`[*, 18.3)`	Frontend File Manager <= 18.2 - Unauthenticated Post Meta Change	July 12, 2021	18.3	Medium

Selected source records

Latest Records

HighCVE-2026-8095

Frontend File Manager Plugin <= 23.6 - Authenticated (Subscriber+) Arbitrary File Deletion

Published: June 27, 2026

Affected versions: *-23.6
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2026-8378

Frontend File Manager Plugin <= 23.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting

Published: June 25, 2026

Affected versions: *-23.6
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2026-8379

Frontend File Manager Plugin <= 23.6 - Missing Authorization to Unauthenticated File Download

Published: June 25, 2026

Affected versions: *-23.6
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2026-5337

Frontend File Manager <= 23.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Download Access

Published: April 11, 2026

Affected versions: *-23.6
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2026-0829

Frontend File Manager <= 23.5 - Missing Authorization

Published: February 17, 2026

Affected versions: *-23.5
Patched versions: Not supplied

Original Wordfence record

HighCVE-2026-1280

Frontend File Manager Plugin <= 23.5 - Missing Authorization to Unauthenticated Arbitrary File Sharing via 'file_id' Parameter

Published: January 27, 2026

Affected versions: *-23.5
Patched versions: 23.6

Original Wordfence record

MediumCVE-2026-25005

Frontend File Manager Plugin <= 23.5 - Unauthenticated Insecure Direct Object Reference

Published: January 16, 2026

Affected versions: *-23.5
Patched versions: 23.6

Original Wordfence record

HighCVE-2025-14804

Frontend File Manager <= 23.4 - Authenticated (Subscriber+) Arbitrary File Deletion

Published: December 17, 2025

Affected versions: *-23.4
Patched versions: 23.5

Original Wordfence record

Highest-Severity Records

CriticalCVE-2021-4368

Frontend File Manager <= 18.2 - Authenticated Settings Change leading to Arbitrary File Upload

Published: July 12, 2021

Affected versions: [*, 18.3)
Patched versions: 18.3

Original Wordfence record

CriticalCVE-2016-15042

Frontend File Manager < 4.0 & N-Media Post Front-end Form < 1.1 & - Arbitrary File Upload

Published: July 16, 2016

Affected versions: *-1.0
Patched versions: 1.1

Affected versions: [*, 4.0)
Patched versions: 4.0

Original Wordfence record

Critical

Frontend File Manager <= 3.7 - Arbitrary File Upload

Published: June 10, 2015

Affected versions: *-3.7
Patched versions: 3.8

Original Wordfence record

CriticalCVE-2023-5105

Frontend File Manager Plugin <= 22.5 - Authenticated (Editor+) Directory Traversal

Published: November 13, 2023

Affected versions: *-22.5
Patched versions: 22.6

Original Wordfence record

CriticalCVE-2021-4356

Frontend File Manager <= 18.2 - Unauthenticated Arbitrary File Download

Published: July 12, 2021

Affected versions: [*, 18.3)
Patched versions: 18.3

Original Wordfence record

HighCVE-2022-3126

Frontend File Manager Plugin <= 21.2 - Cross-Site Request Forgery to File Upload

Published: September 26, 2022

Affected versions: *-21.2
Patched versions: 21.3

Original Wordfence record

High

Frontend File Manager <= 21.3 - Cross-Site Request Forgery to Plugin Settings Update

Published: September 6, 2022

Affected versions: *-21.3
Patched versions: 21.4

Original Wordfence record

HighCVE-2022-3125

Frontend File Manager <= 21.2 - Authenticated (Subscriber+) Arbitrary File Upload

Published: September 7, 2022

Affected versions: *-21.2
Patched versions: 21.3

Original Wordfence record

Currently Marked Unpatched Records

HighCVE-2026-8095

Frontend File Manager Plugin <= 23.6 - Authenticated (Subscriber+) Arbitrary File Deletion

Published: June 27, 2026

Affected versions: *-23.6
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2026-8378

Frontend File Manager Plugin <= 23.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting

Published: June 25, 2026

Affected versions: *-23.6
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2026-8379

Frontend File Manager Plugin <= 23.6 - Missing Authorization to Unauthenticated File Download

Published: June 25, 2026

Affected versions: *-23.6
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2026-5337

Frontend File Manager <= 23.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Download Access

Published: April 11, 2026

Affected versions: *-23.6
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2026-0829

Frontend File Manager <= 23.5 - Missing Authorization

Published: February 17, 2026

Affected versions: *-23.5
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2025-27358

Frontend File Manager <= 23.2 - Missing Authorization to Authenticated (Subscriber+) Content Injection

Published: July 4, 2025

Affected versions: *-23.2
Patched versions: Not supplied

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory