Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.1.5 - Missing Authorization to Authenticated (Author+) Media Replacement
medium
The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to Unauthorized Arbitrary Media Replacement in all versions up to, and including, 3.1.5. This is due to missing object-level authorization checks in the handle_folders_file_upload() function....
- CVSS:
- 4.3
- Affected:
- up to 3.1.5
- Fixed in:
- 3.1.6
- Disclosed:
- Jan 7, 2026
CVE-2025-12640 on NVD →
Folders <= 3.1.5 - Incorrect Authorization to Authenticated (Contributor+) Folder Content Manipulation
medium
The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on the 'wcp_change_post_folder' function in all versions up to, and including, 3.1.5. This makes it possible for au...
- CVSS:
- 4.3
- Affected:
- up to 3.1.5
- Fixed in:
- 3.1.6
- Disclosed:
- Nov 26, 2025
CVE-2025-12971 on NVD →
Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG File Upload
medium
The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authentic...
- CVSS:
- 6.4
- Affected:
- up to 3.0.3
- Fixed in:
- 3.0.4
- Disclosed:
- Aug 5, 2024
CVE-2024-7317 on NVD →
Folders <= 3.0 and Folders Pro <= 3.0.2 - Directory Traversal via handle_folders_file_upload
medium
The Folders and Folders Pro plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.0 in Folders and 3.0.2 in Folders Pro via the 'handle_folders_file_upload' function. This makes it possible for authenticated attackers, with author access and above, to upload files to arbitrar...
- CVSS:
- 4.3
- Affected:
- up to 3.0
- Fixed in:
- 3.0.1
- Disclosed:
- Jun 13, 2024
CVE-2024-2023 on NVD →
Folders Pro <= 3.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User First Name and Last Name
medium
The Folders Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user's First Name and Last Name in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to i...
- CVSS:
- 5.4
- Affected:
- up to 3.0.2
- Fixed in:
- 3.0.3
- Disclosed:
- May 3, 2024
CVE-2024-3868 on NVD →
Folders <= 2.9.2 - Authenticated (Author+) Arbitrary File Upload in handle_folders_file_upload
high
The Folders plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handle_folders_file_upload function in versions up to, and including, 2.9.2. This makes it possible for authenticated attackers, with author-level permissions or above, to upload arbitrary files on the af...
- CVSS:
- 8.8
- Affected:
- up to 2.9.2
- Fixed in:
- 2.9.3
- Disclosed:
- Aug 28, 2023
CVE-2023-40204 on NVD →
Folders <= 2.9.2 - Authenticated (Author+) Arbitrary File Upload
high
The Folders plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handle_folders_file_upload function in versions up to, and including, 2.9.2. This makes it possible for authors or higher to upload arbitrary files on the affected site's server which may make remote code...
- CVSS:
- 8.8
- Affected:
- up to 2.9.3
- Fixed in:
- 2.9.3
- Disclosed:
- Aug 25, 2023
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database