Simple File List

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

Not enough tracked days yet to call a direction. Momentum needs at least three keywords measured a week or more apart.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

0 searches this plugin appeared in over the last 90 days. 5 of its tags aren't in the top 24 for their own search.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 13% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 5 months ago; a band this size takes about a year or more to cross, which places it about 63% of the way through.

1. ★★★★★ Dwayne

   4mo ago

   Plugin works ok. I can’t set the file upload path to match where my uploads is as it’s top default directory is not high enough. It needs to have a better way to specify the directory for uploads, rather than be relative to WP content dir.Also I was rather annoyed to find out PDF thumbnails don’t work on Windows. After a day of getting thumbnails to work, only to see the very small writing that states it doesn’t work. maybe make that writing ‘red’ as it doesn’t stand out enough.

   Read on wp.org ↗
2. ★★★★★ stefantrajanov

   10mo ago

   Perfect plugin, works as described.

   Read on wp.org ↗
3. ★★★★★ premier25

   1.6y ago

   stop making things that you claim are free and then there’s nothing that works unless you pay.

   Read on wp.org ↗
4. ★★★★★ FredEval

   2.5y ago

   Version 5 worked well, but the uploading UI on the backend was a bit odd. Version 6 really is a nice improvement. Been using the plugin for a few years, easy to manage and a great way to organize shared and hidden files as needed right on your server.

   Read on wp.org ↗
5. ★★★★★ byzgl

   3.2y ago

   Absolutely brilliant, thank you.

   Read on wp.org ↗
6. ★★★★★ mlipenk

   3.7y ago

   This plugin is a lifesaver when you need a simple way to present a list of hundreds of viewable / downloadable files to the enduser as part of a document library or catalog. Or if you want bulk file uploads, organized separately from the abyss of the default media library, with consistent web addresses that don’t have WordPress’s year-month organization. The ability to password protect the upload location and do file overwriting is a major plus. There are so many other useful settings and features that I could go on and on. For the price, the Pro option and extensions were a no-brainer for me. Kudos to the developer of this plugin!

   Read on wp.org ↗
7. ★★★★★ abqphotog

   5.8y ago

   Just what I’ve been looking for, a very simple way for users to upload/download files. Very easy to use and the developer responds quickly for support.

   Read on wp.org ↗
8. ★★★★★ QGofLake

   5.9y ago

   I needed to add a directory for users to exchange files and SFL does the job quite well. Some of the other plugins I looked at try to do too many other things. SFL does the task just as needed. I had some plugin conflicts going on and Mitch was quite helpful. The pro version and extensions are well worth it. This topic was modified 5 years, 8 months ago by QGofLake.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 6.3.11 Performance: Admin-only WordPress files ( wp-admin/includes/plugin.php ) are no longer loaded on frontend page requests, reducing memory usage on every page with the shortcode. Performance: The email sharing class is now 6.3.11
2. — Version 6.3.10 Security Fix: Archive extraction and folder delete dispatch code removed from the free plugin — both are Pro-only features and have no attack surface in the free version. Security Fix: Removed broken && !is_admin() short 6.3.10
3. — Version 6.3.9 Security Fix: Reflected XSS — the current page URL was embedded into a JavaScript variable block without escaping. Applied esc_js() to all PHP values interpolated into the front-end JavaScript output. 6.3.9
4. — Version 6.3.8 Security Fix: Added capability checks to admin AJAX handlers simplefilelist_confirm and simplefilelist_dismiss — previously accessible to any logged-in user (CVE-2025-68591). Security Fix: Replaced broken is_admin() auth 6.3.8
5. — Version 6.3.7 Security Fix: Removed the frontmanage shortcode attribute that allowed Contributors and Authors to bypass administrator security settings. Security Fix: Email handler now validates the AllowFrontSend setting before proce 6.3.7
6. — Version 6.3.6 NEW: Inline Media Player is now included free — audio and video files play directly in the browser. NEW: Email File Sharing is now included free — users can send file links by email from the file manager. NEW: Bulk File 6.3.6

3 open vulnerabilities affect the current version (6.3.11). 19 of 22 disclosed are patched.

1. Open Critical · 9.1 Simple File List <= 6.3.11 - Unauthenticated Arbitrary File Deletion ↗
   2026-10-05 CVE-2026-39792 Improper Limitation of a Pathname to a Restricted Directory Affects <= 6.3.11 No patch available
2. Open High · 7.2 Simple File List <= 6.3.11 - Unauthenticated Stored Cross-Site Scripting ↗
   2026-08-21 CVE-2026-16617 Improper Neutralization of Input During Web Page Generation Affects <= 6.3.11 No patch available
3. Open High · 7.5 Simple File List <= 6.3.11 - Unauthenticated Arbitrary File Read ↗
   2026-08-21 CVE-2026-16616 Improper Limitation of a Pathname to a Restricted Directory Affects <= 6.3.11 No patch available
4. Patched Medium · 6.1 Simple File List <= 6.3.8 - Reflected Cross-Site Scripting ↗
   2026-07-07 CVE-2026-57382 Improper Neutralization of Input During Web Page Generation Affects <= 6.3.8 Patched in 6.3.9
5. Patched Medium · 6.5 Simple File List <= 6.3.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Operations (Deletion / Move / Folder Creation / Download) via 'frontmanage' Shortcode Attribute ↗
   2026-06-19 CVE-2026-12119 Missing Authorization Affects <= 6.3.7 Patched in 6.3.8
6. Patched High · 7.5 Simple File List <= 6.3.7 - Unauthenticated Arbitrary File Deletion via Path Traversal in 'eeSubFolder' Parameter ↗
   2026-06-19 CVE-2026-11911 Improper Limitation of a Pathname to a Restricted Directory Affects <= 6.3.7 Patched in 6.3.8
7. Patched High · 7.5 Simple File List <= 6.3.7 - Missing Authorization to Unauthenticated File Modification via simplefilelist_edit_job AJAX Action ↗
   2026-06-19 CVE-2026-11912 Missing Authorization Affects <= 6.3.7 Patched in 6.3.8
8. Patched Medium · 6.5 Simple File List <= 6.1.15 - Authenticated (Subscriber+) Arbitrary File Download ↗
   2026-02-09 CVE-2026-24953 Improper Limitation of a Pathname to a Restricted Directory Affects <= 6.1.15 Patched in 6.1.16
9. Patched Medium · 4.3 Simple File List <= 6.3.7 - Missing Authorization ↗
   2025-12-25 CVE-2025-68591 Missing Authorization Affects <= 6.3.7 Patched in 6.3.8
10. Patched Medium · 5.3 Simple File List <= 6.1.14 - Unauthenticated Arbitrary File Download ↗
    2025-07-28 CVE-2025-54021 Improper Limitation of a Pathname to a Restricted Directory Affects <= 6.1.14 Patched in 6.1.15
11. Patched Medium · 5.3 Simple File List <= 6.1.13 - Missing Authorization to Unauthenticated Minor Settings Update ↗
    2025-05-07 CVE-2025-47450 Missing Authorization Affects <= 6.1.13 Patched in 6.1.14
12. Patched Medium · 6.1 Simple File List <= 6.1.11 - Reflected Cross-Site Scripting ↗
    2024-10-24 CVE-2024-10146 Improper Neutralization of Input During Web Page Generation Affects <= 6.1.12 Patched in 6.1.13
13. Patched Medium · 4.4 Simple File List <= 6.1.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings ↗
    2023-10-12 CVE-2023-39924 Improper Neutralization of Input During Web Page Generation Affects <= 6.1.9 Patched in 6.1.10
14. Patched Critical · 9.1 Simple File List <= 6.1.9 - Unauthenticated Arbitrary File Deletion ↗
    2023-09-28 CVE-2023-44227 Improper Limitation of a Pathname to a Restricted Directory Affects <= 6.1.9 Patched in 6.1.10
15. Patched Medium · 4.4 Simple File List <= 6.0.9 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2023-02-28 CVE-2023-1025 Improper Neutralization of Input During Web Page Generation Affects <= 6.0.9 Patched in 6.0.10
16. Patched Medium · 6.1 Simple File List <= 4.4.11 - Reflected Cross-Site Scripting ↗
    2022-09-19 CVE-2022-3207 Improper Neutralization of Input During Web Page Generation Affects <= 4.4.11 Patched in 4.4.12
17. Patched High · 8.8 Simple File List <= 4.4.12 - Cross-Site Request Forgery to Page Creation ↗
    2022-09-19 CVE-2022-3208 Cross-Site Request Forgery Affects <= 4.4.12 Patched in 4.4.13
18. Patched Medium · 6.1 Simple File List <= 4.4.11 - Reflected Cross-Site Scripting ↗
    2022-08-26 CVE-2022-3062 Improper Neutralization of Input During Web Page Generation Affects <= 4.4.11 Patched in 4.4.12
19. Patched Critical · 9.8 Simple File List < 4.2.3 - Remote Code Execution ↗
    2020-11-02 CVE-2020-36847 Unrestricted Upload of File with Dangerous Type Affects < 4.2.3 Patched in 4.2.3
20. Patched Medium · 6.5 Simple File List <= 4.2.7 - Arbitrary File Deletion ↗
    2020-05-16 CVE-2020-12832 Improper Limitation of a Pathname to a Restricted Directory Affects <= 4.2.7 Patched in 4.2.8
21. Patched High · 8.6 Simple File List <= 3.2.4 - Arbitrary File Deletion ↗
    2019-05-23 Improper Limitation of a Pathname to a Restricted Directory Affects <= 3.2.4 Patched in 3.2.5
22. Patched High · 7.5 Simple File List <= 3.2.7 - Arbitrary File Download ↗
    2019-05-23 CVE-2022-1119 Improper Limitation of a Pathname to a Restricted Directory Affects <= 3.2.7 Patched in 3.2.8

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 3 languages, 0 at 90% or more

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Not measured yet for this plugin’s topics. Its tracked searches are not among the measured topics. See the topics measured so far.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-06-18 4K+ → 3K+ down after 6 days in tier
2. 2026-06-12 5K+ → 4K+ down after 188 days in tier
3. 2025-12-06 6K+ → 5K+ down after 59 days in tier
4. 2025-10-08 5K+ → 6K+ up after 64 days in tier
5. 2025-08-05 6K+ → 5K+ down after 46 days in tier
6. 2025-06-20 7K+ → 6K+ down after 97 days in tier
7. 2025-03-15 6K+ → 7K+ up after 204 days in tier
8. 2024-08-23 5K+ → 6K+ up after 156 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for Simple File List into a readme, a review or a deck. It updates itself.

Simple File List: 3K+ active installs, 4.3★ (27 reviews). Plugin Pulse (WP Mayor), as of 2026-10-31. https://plugins.wpmayor.com/plugin/simple-file-list