https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-63678.htmlhttps://patchthecve.com/cve/CVE-2025-63678.htmlWed, 17 Jun 2026 09:53:21 +0000HIGH 7.2: An authenticated arbitrary file upload vulnerability in the /uploads/ endpoint of CMS Made Simple Foundation File Manager v2.2.22 allows attackers with Administrator privileges to execute arbitrary code via uploading a crafted PHP file.https://patchthecve.com/cve/CVE-2024-8918.htmlhttps://patchthecve.com/cve/CVE-2024-8918.htmlWed, 17 Jun 2026 08:23:33 +0000HIGH 7.4: The File Manager Pro plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up to, and including, 8.3.9. This is due to a lack of proper checks on allowed file types. This makes it possible for unauthenticated attackers, with permissions granted by an administrator, to https://patchthecve.com/cve/CVE-2024-8746.htmlhttps://patchthecve.com/cve/CVE-2024-8746.htmlWed, 17 Jun 2026 08:23:13 +0000HIGH 7.5: The File Manager Pro plugin for WordPress is vulnerable to arbitrary backup file downloads and uploads due to missing file type validation via the 'mk_file_folder_manager_shortcode' ajax action in all versions up to, and including, 8.3.9. This makes it possible for unauthenticated attackers, if granhttps://patchthecve.com/cve/CVE-2024-8507.htmlhttps://patchthecve.com/cve/CVE-2024-8507.htmlWed, 17 Jun 2026 08:22:45 +0000HIGH 8.8: The File Manager Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.3.9. This is due to missing or incorrect nonce validation on the 'mk_file_folder_manager' ajax action. This makes it possible for unauthenticated attackers to upload arbitrarhttps://patchthecve.com/cve/CVE-2018-25105.htmlhttps://patchthecve.com/cve/CVE-2018-25105.htmlWed, 17 Jun 2026 01:54:43 +0000CRITICAL 9.8: The File Manager plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the /inc/root.php file in versions up to, and including, 3.0. This makes it possible for unauthenticated attackers to download arbitrary files from the server and upload arbitrary files https://patchthecve.com/cve/CVE-2024-7770.htmlhttps://patchthecve.com/cve/CVE-2024-7770.htmlWed, 17 Jun 2026 08:20:53 +0000HIGH 8.8: The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload' function in all versions up to, and including, 6.5.5. This makes it possible for authenticated athttps://patchthecve.com/cve/CVE-2024-7627.htmlhttps://patchthecve.com/cve/CVE-2024-7627.htmlWed, 17 Jun 2026 08:20:34 +0000HIGH 8.1: The Bit File Manager plugin for WordPress is vulnerable to Remote Code Execution in versions 6.0 to 6.5.5 via the 'checkSyntax' function. This is due to writing a temporary file to a publicly accessible directory before performing file validation. This makes it possible for unauthenticated attackershttps://patchthecve.com/cve/CVE-2023-26321.htmlhttps://patchthecve.com/cve/CVE-2023-26321.htmlWed, 17 Jun 2026 05:43:03 +0000MEDIUM 6.3: A path traversal vulnerability exists in the Xiaomi File Manager application product(international version). The vulnerability is caused by unfiltered special characters and can be exploited by attackers to overwrite and execute code in the file.https://patchthecve.com/cve/CVE-2024-2654.htmlhttps://patchthecve.com/cve/CVE-2024-2654.htmlWed, 17 Jun 2026 07:24:58 +0000MEDIUM 6.8: The File Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.2.5 via the fm_download_backup function. This makes it possible for authenticated attackers, with administrator access and above, to read the contents of arbitrary zip files on the serv