Skip to content
Noroxi

Frontend File Manager Plugin

nmedia-user-file-uploader · plugin

Known security vulnerabilities for Frontend File Manager Plugin. Find out in seconds which version runs on your site with WP Lens.

15 known vulnerabilities

2 critical · 10 exploitable without logging in · 1 with public exploit code · latest Jun 27, 2026

Closed on wordpress.org

Removed from the directory on May 27, 2026 · reason: security issue. A closed component gets no more updates; installed copies keep running and their vulnerabilities stay open. Remove it or replace it with a maintained alternative.

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

  • CVE-2016-15042unauthenticated→ 4.0

    Frontend File Manager < 4.0 & N-Media Post Front-end Form < 1.1 & - Arbitrary File Upload

    Critical 9.8

  • CVE-2021-4356unauthenticated→ 18.3

    Frontend File Manager <= 18.2 - Unauthenticated Arbitrary File Download

    Critical 9.8

  • CVE-2021-4368login required→ 18.3

    Frontend File Manager <= 18.2 - Authenticated Settings Change leading to Arbitrary File Upload

    High 8.8

  • CVE-2026-8095subscriber+≤ 23.6

    Frontend File Manager Plugin <= 23.6 - Authenticated (Subscriber+) Arbitrary File Deletion

    High 8.1

  • CVE-2026-1280unauthenticated≤ 23.5

    Frontend File Manager Plugin <= 23.5 - Missing Authorization to Unauthenticated Arbitrary File Sharing via 'file_id' Parameter

    High 7.5

  • CVE-2023-7306unauthenticated≤ 21.5

    Frontend File Manager <= 21.5 - Missing Authorization to Unauthenticated Arbitrary Post Deletion

    High 7.5

  • CVE-2024-25903unauthenticated≤ 22.7

    WordPress Frontend File Manager Plugin plugin <= 22.7 - Sensitive Data Exposure vulnerability

    High 7.5

  • CVE-2021-4365unauthenticated→ 18.3

    Frontend File Manager <= 18.2 - Unauthenticated Stored Cross-Site Scripting

    Medium 6.1

  • CVE-2026-25005unauthenticated≤ 23.5

    WordPress Frontend File Manager plugin <= 23.5 - Insecure Direct Object References (IDOR) vulnerability

    Medium 5.3

  • CVE-2025-57921unauthenticated≤ 23.3

    WordPress Frontend File Manager plugin <= 23.3 - Broken Access Control vulnerability

    Medium 5.3

  • CVE-2021-4369unauthenticated→ 18.3

    Frontend File Manager <= 18.2 - Unauthenticated Content Injection

    Medium 5.3

  • CVE-2021-4359unauthenticated→ 18.3

    Frontend File Manager Plugin <= 18.2 - Unauthenticated Arbitrary Post Deletion

    Medium 5.3

  • CVE-2025-27358login required≤ 23.6

    WordPress Frontend File Manager plugin <= 23.6 - Content Injection vulnerability

    Medium 4.6

  • CVE-2025-13382subscriber+≤ 23.4

    Frontend File Manager Plugin <= 23.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary File Renaming

    Medium 4.3

  • CVE-2025-64265login required≤ 23.2

    WordPress Frontend File Manager plugin <= 23.2 - Broken Access Control vulnerability

    Medium 4.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory