Simple File List

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 13% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. A small install base leaves thin data to model from. A declining trend compresses what a buyer would pay.

1. ★★★★★ Dwayne

   2mo ago

   Plugin works ok. I can’t set the file upload path to match where my uploads is as it’s top default directory is not high enough. It needs to have a better way to specify the directory for uploads, rather than be relative to WP content dir.Also I was rather annoyed to find out PDF thumbnails don’t work on Windows. After a day of getting thumbnails to work, only to see the very small writing that states it doesn’t work. maybe make that writing ‘red’ as it doesn’t stand out enough.

   Read on wp.org ↗
2. ★★★★★ stefantrajanov

   7mo ago

   Perfect plugin, works as described.

   Read on wp.org ↗
3. ★★★★★ premier25

   1.4y ago

   stop making things that you claim are free and then there’s nothing that works unless you pay.

   Read on wp.org ↗
4. ★★★★★ FredEval

   2.4y ago

   Version 5 worked well, but the uploading UI on the backend was a bit odd. Version 6 really is a nice improvement. Been using the plugin for a few years, easy to manage and a great way to organize shared and hidden files as needed right on your server.

   Read on wp.org ↗
5. ★★★★★ byzgl

   3.0y ago

   Absolutely brilliant, thank you.

   Read on wp.org ↗
6. ★★★★★ mlipenk

   3.5y ago

   This plugin is a lifesaver when you need a simple way to present a list of hundreds of viewable / downloadable files to the enduser as part of a document library or catalog. Or if you want bulk file uploads, organized separately from the abyss of the default media library, with consistent web addresses that don’t have WordPress’s year-month organization. The ability to password protect the upload location and do file overwriting is a major plus. There are so many other useful settings and features that I could go on and on. For the price, the Pro option and extensions were a no-brainer for me. Kudos to the developer of this plugin!

   Read on wp.org ↗
7. ★★★★★ abqphotog

   5.6y ago

   Just what I’ve been looking for, a very simple way for users to upload/download files. Very easy to use and the developer responds quickly for support.

   Read on wp.org ↗
8. ★★★★★ QGofLake

   5.8y ago

   I needed to add a directory for users to exchange files and SFL does the job quite well. Some of the other plugins I looked at try to do too many other things. SFL does the task just as needed. I had some plugin conflicts going on and Mitch was quite helpful. The pro version and extensions are well worth it. This topic was modified 5 years, 8 months ago by QGofLake.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 6.3.11 Performance: Admin-only WordPress files ( wp-admin/includes/plugin.php ) are no longer loaded on frontend page requests, reducing memory usage on every page with the shortcode. Performance: The email sharing class is now 6.3.11
2. — Version 6.3.10 Security Fix: Archive extraction and folder delete dispatch code removed from the free plugin — both are Pro-only features and have no attack surface in the free version. Security Fix: Removed broken && !is_admin() short 6.3.10
3. — Version 6.3.9 Security Fix: Reflected XSS — the current page URL was embedded into a JavaScript variable block without escaping. Applied esc_js() to all PHP values interpolated into the front-end JavaScript output. 6.3.9
4. — Version 6.3.8 Security Fix: Added capability checks to admin AJAX handlers simplefilelist_confirm and simplefilelist_dismiss — previously accessible to any logged-in user (CVE-2025-68591). Security Fix: Replaced broken is_admin() auth 6.3.8
5. — Version 6.3.7 Security Fix: Removed the frontmanage shortcode attribute that allowed Contributors and Authors to bypass administrator security settings. Security Fix: Email handler now validates the AllowFrontSend setting before proce 6.3.7
6. — Version 6.3.6 NEW: Inline Media Player is now included free — audio and video files play directly in the browser. NEW: Email File Sharing is now included free — users can send file links by email from the file manager. NEW: Bulk File 6.3.6

21 disclosed vulnerabilities on record for this plugin, 2 still affect the current version.

1. High · 7.2 Simple File List <= 6.3.11 - Unauthenticated Stored Cross-Site Scripting ↗
   2026-08-21 CVE-2026-16617 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 6.3.11 No patch available
2. High · 7.5 Simple File List <= 6.3.11 - Unauthenticated Arbitrary File Read ↗
   2026-08-21 CVE-2026-16616 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 6.3.11 No patch available
3. Medium · 6.1 Simple File List <= 6.3.8 - Reflected Cross-Site Scripting ↗
   2026-07-07 CVE-2026-57382 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 6.3.8 Patched in 6.3.9
4. Medium · 6.5 Simple File List <= 6.3.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Operations (Deletion / Move / Folder Creation / Download) via 'frontmanage' Shortcode Attribute ↗
   2026-06-19 CVE-2026-12119 Missing Authorization Affects <= 6.3.7 Patched in 6.3.8
5. High · 7.5 Simple File List <= 6.3.7 - Unauthenticated Arbitrary File Deletion via Path Traversal in 'eeSubFolder' Parameter ↗
   2026-06-19 CVE-2026-11911 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 6.3.7 Patched in 6.3.8
6. High · 7.5 Simple File List <= 6.3.7 - Missing Authorization to Unauthenticated File Modification via simplefilelist_edit_job AJAX Action ↗
   2026-06-19 CVE-2026-11912 Missing Authorization Affects <= 6.3.7 Patched in 6.3.8
7. Medium · 6.5 Simple File List <= 6.1.15 - Authenticated (Subscriber+) Arbitrary File Download ↗
   2026-02-09 CVE-2026-24953 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 6.1.15 Patched in 6.1.16
8. Medium · 4.3 Simple File List <= 6.3.7 - Missing Authorization ↗
   2025-12-25 CVE-2025-68591 Missing Authorization Affects <= 6.3.7 Patched in 6.3.8
9. Medium · 5.3 Simple File List <= 6.1.14 - Unauthenticated Arbitrary File Download ↗
   2025-07-28 CVE-2025-54021 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 6.1.14 Patched in 6.1.15
10. Medium · 5.3 Simple File List <= 6.1.13 - Missing Authorization to Unauthenticated Minor Settings Update ↗
    2025-05-07 CVE-2025-47450 Missing Authorization Affects <= 6.1.13 Patched in 6.1.14
11. Medium · 6.1 Simple File List <= 6.1.11 - Reflected Cross-Site Scripting ↗
    2024-10-24 CVE-2024-10146 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 6.1.12 Patched in 6.1.13
12. Medium · 4.4 Simple File List <= 6.1.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings ↗
    2023-10-12 CVE-2023-39924 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 6.1.9 Patched in 6.1.10
13. Critical · 9.1 Simple File List <= 6.1.9 - Unauthenticated Arbitrary File Deletion ↗
    2023-09-28 CVE-2023-44227 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 6.1.9 Patched in 6.1.10
14. Medium · 4.4 Simple File List <= 6.0.9 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2023-02-28 CVE-2023-1025 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 6.0.9 Patched in 6.0.10
15. Medium · 6.1 Simple File List <= 4.4.11 - Reflected Cross-Site Scripting ↗
    2022-09-19 CVE-2022-3207 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.4.11 Patched in 4.4.12
16. High · 8.8 Simple File List <= 4.4.12 - Cross-Site Request Forgery to Page Creation ↗
    2022-09-19 CVE-2022-3208 Cross-Site Request Forgery (CSRF) Affects <= 4.4.12 Patched in 4.4.13
17. Medium · 6.1 Simple File List <= 4.4.11 - Reflected Cross-Site Scripting ↗
    2022-08-26 CVE-2022-3062 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.4.11 Patched in 4.4.12
18. Critical · 9.8 Simple File List < 4.2.3 - Remote Code Execution ↗
    2020-11-02 CVE-2020-36847 Unrestricted Upload of File with Dangerous Type Affects < 4.2.3 Patched in 4.2.3
19. Medium · 6.5 Simple File List <= 4.2.7 - Arbitrary File Deletion ↗
    2020-05-16 CVE-2020-12832 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 4.2.7 Patched in 4.2.8
20. High · 8.6 Simple File List <= 3.2.4 - Arbitrary File Deletion ↗
    2019-05-23 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 3.2.4 Patched in 3.2.5
21. High · 7.5 Simple File List <= 3.2.7 - Arbitrary File Download ↗
    2019-05-23 CVE-2022-1119 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 3.2.7 Patched in 3.2.8

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 3 languages, 0 at 90% or more

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-06-18 4K+ → 3K+ down after 6 days in tier
2. 2026-06-12 5K+ → 4K+ down after 188 days in tier
3. 2025-12-06 6K+ → 5K+ down after 59 days in tier
4. 2025-10-08 5K+ → 6K+ up after 64 days in tier
5. 2025-08-05 6K+ → 5K+ down after 46 days in tier
6. 2025-06-20 7K+ → 6K+ down after 97 days in tier
7. 2025-03-15 6K+ → 7K+ up after 204 days in tier
8. 2024-08-23 5K+ → 6K+ up after 156 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Document Library Lite 4K+ installs · 3.9★ · 2 shared tags B
• Shared Files – File Upload & Download Manager 4K+ installs · 4.3★ · 2 shared tags A
• User Private Files – Secure Client Portal & File Sharing for WordPress 1K+ installs · 4.3★ · 2 shared tags A
• Filr – Secure document library 700+ installs · 4.3★ · 2 shared tags A
• Kistenstein Club Document Portal — installs · 3.6★ · 2 shared tags B
• Ask Adam Doc It — installs · 3.6★ · 2 shared tags B

Embed this report card

Drop a live Pulse card for Simple File List into a readme, a review or a deck. It updates itself.

Simple File List: 3K+ active installs, 4.3★ (27 reviews). Plugin Pulse (WP Mayor), as of 2026-08-29. https://plugins.wpmayor.com/plugin/simple-file-list