Skip to content
Founder-led WordPress incident response and care Request an assessment
3zerodigital Request a Website Assessment

Plugin security history

Frontend File Manager Plugin Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 30 vulnerability records associated with Frontend File Manager Plugin, published between 2014 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

30Total records
5Critical
10High
15Medium
0Low
0Informational
24Patched records
6Currently marked unpatched
2014-09-25First disclosure
2026-06-27Latest disclosure
28 of 30CVE coverage

Year-by-Year Timeline

YearRecordsRelative volume
201411 records
201511 records
201611 records
202188 records
202244 records
202311 records
202411 records
202566 records
202677 records

Severity Breakdown

SeverityRecordsShare
Critical516.7%
High1033.3%
Medium1550%

Vulnerability-Type Breakdown

Missing Authorization

18 records60%

First: 2021. Latest: 2026.

Arbitrary File Upload

4 records13.3%

First: 2014. Latest: 2022.

Path Traversal

3 records10%

First: 2023. Latest: 2026.

Cross-Site Scripting

2 records6.7%

First: 2021. Latest: 2026.

CSRF

2 records6.7%

First: 2022. Latest: 2022.

Information Disclosure

1 record3.3%

First: 2024. Latest: 2024.

Patch Status

Patched
24
Currently marked unpatched
6
Unknown status
0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

  • 23.6
  • 23.5
  • 23.3
  • 23.4
  • 22.0
  • 22.8
  • 22.6
  • 21.3
  • 21.4
  • 18.3
  • 4.0
  • 3.8
  • 3.6

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected rangeVulnerabilityPublishedPatched versionSeverity
[*, 18.3)Frontend File Manager <= 18.2 - Unauthenticated HTML Injection leading to Spam EmailsJuly 12, 202118.3High
[*, 18.3)Frontend File Manager <= 18.2 - Privilege EscalationJuly 12, 202118.3Medium
[*, 4.0)Frontend File Manager < 4.0 & N-Media Post Front-end Form < 1.1 & - Arbitrary File UploadJuly 16, 20164.0Critical
*-3.7Frontend File Manager <= 3.7 - Arbitrary File UploadJune 10, 20153.8Critical
[*, 3.6)Frontend File Manager Plugin < 3.6 - Arbitrary File UploadSeptember 25, 20143.6High

Selected source records

Latest Records

HighCVE-2026-8095

Frontend File Manager Plugin <= 23.6 - Authenticated (Subscriber+) Arbitrary File Deletion

Published: June 27, 2026

Affected versions
*-23.6
Patched versions
Not supplied
Original Wordfence record
MediumCVE-2026-8378

Frontend File Manager Plugin <= 23.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting

Published: June 25, 2026

Affected versions
*-23.6
Patched versions
Not supplied
Original Wordfence record
MediumCVE-2026-8379

Frontend File Manager Plugin <= 23.6 - Missing Authorization to Unauthenticated File Download

Published: June 25, 2026

Affected versions
*-23.6
Patched versions
Not supplied
Original Wordfence record
MediumCVE-2026-5337

Frontend File Manager <= 23.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Download Access

Published: April 11, 2026

Affected versions
*-23.6
Patched versions
Not supplied
Original Wordfence record
MediumCVE-2026-0829

Frontend File Manager <= 23.5 - Missing Authorization

Published: February 17, 2026

Affected versions
*-23.5
Patched versions
Not supplied
Original Wordfence record
HighCVE-2026-1280

Frontend File Manager Plugin <= 23.5 - Missing Authorization to Unauthenticated Arbitrary File Sharing via 'file_id' Parameter

Published: January 27, 2026

Affected versions
*-23.5
Patched versions
23.6
Original Wordfence record
MediumCVE-2026-25005

Frontend File Manager Plugin <= 23.5 - Unauthenticated Insecure Direct Object Reference

Published: January 16, 2026

Affected versions
*-23.5
Patched versions
23.6
Original Wordfence record
HighCVE-2025-14804

Frontend File Manager <= 23.4 - Authenticated (Subscriber+) Arbitrary File Deletion

Published: December 17, 2025

Affected versions
*-23.4
Patched versions
23.5
Original Wordfence record

Highest-Severity Records

CriticalCVE-2021-4368

Frontend File Manager <= 18.2 - Authenticated Settings Change leading to Arbitrary File Upload

Published: July 12, 2021

Affected versions
[*, 18.3)
Patched versions
18.3
Original Wordfence record
CriticalCVE-2016-15042

Frontend File Manager < 4.0 & N-Media Post Front-end Form < 1.1 & - Arbitrary File Upload

Published: July 16, 2016

Affected versions
*-1.0
Patched versions
1.1
Affected versions
[*, 4.0)
Patched versions
4.0
Original Wordfence record
Critical

Frontend File Manager <= 3.7 - Arbitrary File Upload

Published: June 10, 2015

Affected versions
*-3.7
Patched versions
3.8
Original Wordfence record
CriticalCVE-2023-5105

Frontend File Manager Plugin <= 22.5 - Authenticated (Editor+) Directory Traversal

Published: November 13, 2023

Affected versions
*-22.5
Patched versions
22.6
Original Wordfence record
CriticalCVE-2021-4356

Frontend File Manager <= 18.2 - Unauthenticated Arbitrary File Download

Published: July 12, 2021

Affected versions
[*, 18.3)
Patched versions
18.3
Original Wordfence record
HighCVE-2022-3126

Frontend File Manager Plugin <= 21.2 - Cross-Site Request Forgery to File Upload

Published: September 26, 2022

Affected versions
*-21.2
Patched versions
21.3
Original Wordfence record
High

Frontend File Manager <= 21.3 - Cross-Site Request Forgery to Plugin Settings Update

Published: September 6, 2022

Affected versions
*-21.3
Patched versions
21.4
Original Wordfence record
HighCVE-2022-3125

Frontend File Manager <= 21.2 - Authenticated (Subscriber+) Arbitrary File Upload

Published: September 7, 2022

Affected versions
*-21.2
Patched versions
21.3
Original Wordfence record

Currently Marked Unpatched Records

HighCVE-2026-8095

Frontend File Manager Plugin <= 23.6 - Authenticated (Subscriber+) Arbitrary File Deletion

Published: June 27, 2026

Affected versions
*-23.6
Patched versions
Not supplied
Original Wordfence record
MediumCVE-2026-8378

Frontend File Manager Plugin <= 23.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting

Published: June 25, 2026

Affected versions
*-23.6
Patched versions
Not supplied
Original Wordfence record
MediumCVE-2026-8379

Frontend File Manager Plugin <= 23.6 - Missing Authorization to Unauthenticated File Download

Published: June 25, 2026

Affected versions
*-23.6
Patched versions
Not supplied
Original Wordfence record
MediumCVE-2026-5337

Frontend File Manager <= 23.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Download Access

Published: April 11, 2026

Affected versions
*-23.6
Patched versions
Not supplied
Original Wordfence record
MediumCVE-2026-0829

Frontend File Manager <= 23.5 - Missing Authorization

Published: February 17, 2026

Affected versions
*-23.5
Patched versions
Not supplied
Original Wordfence record
MediumCVE-2025-27358

Frontend File Manager <= 23.2 - Missing Authorization to Authenticated (Subscriber+) Content Injection

Published: July 4, 2025

Affected versions
*-23.2
Patched versions
Not supplied
Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware RemovalWordPress Security MaintenanceContact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory