WordPress plugin · nmedia-user-file-uploader
Is Frontend File Manager Plugin safe?
Closed. Replace it.
wordpress.org closed it on May 27, 2026 (security issue), so it gets no more security fixes, and 30 flaws are on record. If your site runs it, move to a maintained alternative.
- Flaws on record
- 30
- High or critical
- 13
- Exploited
- none
Every recorded flaw
- Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Frontend File Manager <= 23.6 versions.CVE-2026-32577 · affects up to 23.6 · reported by PatchstackHigh 7.1
- Aug 2, 2026Frontend File Manager: Does not perform nonce validation on one of its file-metadata update actionsCVE-2026-16292 · affects up to 23.6 · reported by WPScanMedium 5.4
- Jul 7, 2026Frontend File Manager: Does not validate a file path derived from user input before deleting the referenced fileCVE-2026-12277 · affects up to 23.6 · reported by WPScanHigh 8.7
- Jun 27, 2026Frontend File Manager: Authenticated Arbitrary File DeletionCVE-2026-8095 · affects up to 23.6 · reported by WordfenceHigh 8.1
- Jun 26, 2026Frontend File Manager: Does not properly verify ownership of every targeted post before permanent deletionCVE-2026-8380 · affects up to 23.6 · reported by WPScanMedium 6.5
- Jun 23, 2026Frontend File Manager: Does not properly enforce its nonce check on the file download handlerCVE-2026-8379 · affects up to 23.6 · reported by WPScanHigh 7.5
- Jun 23, 2026Frontend File Manager: Does not sanitise nor escape a filename submitted to the frontend file-rename endpoint before storing itCVE-2026-8378 · affects up to 23.6 · reported by WPScanMedium 5.4
- Feb 19, 2026Frontend File Manager: Authorization Bypass Through User-Controlled KeyCVE-2026-25005 · affects up to 23.5 · reported by PatchstackMedium 5.3
- Feb 17, 2026Frontend File Manager: Allows unauthenticated users to send emails through the site without any security checksCVE-2026-0829 · affects up to 23.5 · reported by WPScanMedium 5.8
- Jan 28, 2026Frontend File Manager: Unauthorized file sharingCVE-2026-1280 · affects up to 23.5 · reported by WordfenceHigh 7.5
- Jan 7, 2026Frontend File Manager: Did not validate a path parameter and ownership of the fileCVE-2025-14804 · fixed in 23.5 · reported by WPScanHigh 7.7
- Nov 25, 2025Frontend File Manager: Insecure Direct Object ReferenceCVE-2025-13382 · affects up to 23.4 · reported by WordfenceMedium 4.3
- Nov 13, 2025Frontend File Manager: Missing AuthorizationCVE-2025-64265 · affects up to 23.2 · reported by PatchstackMedium 4.3
- Sep 22, 2025Frontend File Manager: Missing AuthorizationCVE-2025-57921 · affects up to 23.3 · reported by PatchstackMedium 5.3
- Jul 25, 2025Frontend File Manager: Unauthorized loss of dataCVE-2023-7306 · affects up to 21.5 · reported by WordfenceHigh 7.5
- Jul 4, 2025Frontend File Manager: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-27358 · affects up to 23.6 · reported by PatchstackMedium 4.6
- Oct 16, 2024The Frontend File Manager (versions < 4.0), N-Media Post Front-end Form (versions < 1.1) plugins for WordPress are vulnerable to arbitrary file uploads due to mCVE-2016-15042 · reported by Wordfence6.7% oddsCritical 9.8
- Mar 17, 2024Frontend File Manager: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-25903 · affects up to 22.7 · reported by PatchstackMedium 5.3
- Dec 4, 2023Frontend File Manager: Has a vulnerability that allows an Editor+ user to bypass the file download logic and download files suchCVE-2023-5105 · fixed in 22.6 · reported by WPScan1.0% oddsMedium 6.5
- Jun 6, 2023Frontend File Manager: Unauthenticated Content InjectionCVE-2021-4369 · affects up to 18.2 · reported by WordfenceMedium 5.8
- Jun 6, 2023Frontend File Manager: Authenticated Settings ChangeCVE-2021-4368 · affects up to 18.2 · reported by Wordfence1.9% oddsCritical 9.9
- Jun 6, 2023Frontend File Manager: Unauthenticated Stored Cross-Site ScriptingCVE-2021-4365 · affects up to 18.2 · reported by WordfenceHigh 7.2
- Jun 6, 2023Frontend File Manager: Unauthenticated Arbitrary Post DeletionCVE-2021-4359 · affects up to 18.2 · reported by WordfenceMedium 6.5
- Jun 6, 2023The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Download in versions up to, and including, 18.2.CVE-2021-4356 · affects up to 18.2 · reported by Wordfence1.5% oddsCritical 9
- Jun 6, 2023Frontend File Manager: Unauthenticated Post Meta ChangeCVE-2021-4351 · affects up to 18.2 · reported by WordfenceMedium 5.8
- Jun 6, 2023Frontend File Manager: Unauthenticated HTML InjectionCVE-2021-4350 · affects up to 18.2 · reported by WordfenceHigh 7.2
- Jun 6, 2023Frontend File Manager: Privilege EscalationCVE-2021-4344 · affects up to 18.2 · reported by WordfenceMedium 6.4
- Oct 17, 2022Frontend File Manager: Does not have CSRF checkCVE-2022-3126 · fixed in 21.4 · reported by WPScanMedium 4.3
- Oct 3, 2022Frontend File Manager: Allows any authenticated usersCVE-2022-3125 · fixed in 21.3 · reported by WPScan1.6% oddsHigh 8.8
- Oct 3, 2022Frontend File Manager: Allows any unauthenticated user to rename uploaded files from usersCVE-2022-3124 · fixed in 21.3 · reported by WPScan8.3% oddsMedium 5.3
Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Get in touch
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
Not ready to talk yet? Run the free website check and see what Google sees.