Security Fix: Archive extraction and folder delete dispatch code removed from the free plugin — both are Pro-only features and have no attack surface in the free version.
Security Fix: Removed broken && !is_admin() short-circuit from the email send nonce check. is_admin() always returns true on admin-ajax.php, so the nonce was never enforced on AJAX requests.
6.3.9
Security Fix: Reflected XSS — the current page URL was embedded into a JavaScript variable block without escaping. Applied esc_js() to all PHP values interpolated into the front-end JavaScript output.
6.3.8
Security Fix: Added capability checks to admin AJAX handlers simplefilelist_confirm and simplefilelist_dismiss — previously accessible to any logged-in user (CVE-2025-68591).
Security Fix: Replaced broken is_admin() authorization guard with current_user_can(‘manage_options’) in the front-end file management handler. The previous check was always bypassed on AJAX requests.
Security Fix: The eeSubFolder POST parameter is no longer accepted in the file management AJAX handler. Subfolder support is a Pro feature; ignoring this parameter in the free version eliminates the path traversal attack surface (CVE-2026-11911) entirely.
Security: Added a realpath() confinement check in the file delete function as defense-in-depth against path traversal in any file path component.
UX: Added an admin warning when Front-End Management is enabled, reminding administrators that the feature will be open to all page visitors.
6.3.7
Security Fix: Removed the frontmanage shortcode attribute that allowed Contributors and Authors to bypass administrator security settings.
Security Fix: Email handler now validates the AllowFrontSend setting before processing requests.
Important: When AllowFrontManage or AllowFrontSend are enabled in settings, these features are intentionally available to all page visitors. Administrators should secure pages using WordPress’s built-in access controls or page protection plugins.
Breaking Change: Sites using [eeSFL frontmanage=”YES”] must now enable AllowFrontManage in backend List Settings instead.
6.3.6
NEW: Inline Media Player is now included free — audio and video files play directly in the browser.
NEW: Email File Sharing is now included free — users can send file links by email from the file manager.
NEW: Bulk File Management is now included free — apply descriptions, download as zip, or delete multiple files at once with the File Ops Bar.
NEW: Custom File Directory is now included free — define any server path as the file manager’s storage directory.
NEW: Tools extension is now available for the free version.
Improved file and folder name sanitization.
Improved file system methods with PHP fallbacks for better compatibility on managed WordPress hosts (Pressable, Kinsta, WP Engine, etc.).
Removed the Re-Scan Files button — the file manager is scanned on every page load automatically.
Security fix: Upload notification emails are no longer triggered by probes — notifications only send when a file was actually saved.
PDF thumbnail generation no longer requires the Imagick PHP extension — GhostScript alone is sufficient.
Many under-the-hood performance, compatibility, and security improvements.
PHP 8.5 Approved.
6.1.18
Fixed broken translations.
6.1.17
Security Fix: Fixed broken access control vulnerability (CVE-2025-68591) in file management operations.
Added back-end capability checks to help prevent malicious back-end users from circumventing the Back-End Access setting.
Renamed thumbnail default files to remove special characters.
Fixed text domain issues for internationalization.
Major code refactoring and improvements across multiple files.
6.1.15
Addressed a security issue involving file renaming.
6.1.14
Removed the feature to force English on the back-end.
Quelled some PHP 8 depreciation notices.
6.1.13
Security Fix for a reflected cross-site scripting (XSS) issue
Security improvements to back-end navigation tabs.
6.1.11
General Code Improvements
6.1.10
Fixed a major security bug where a malicious attacker could delete your files.
Fixed a minor XSS vulnerability in the email settings form.
6.1.9
Directory Traversal Vulnerability Fix
6.1.8
Bug fix where a fatal error was being thrown on the list settings page for Windows installs.
6.1.7
Bug fix where file names with multiple spaces caused an error on upload.
Bug fix where the file Nice Name was ignored if Preserve File Name was OFF.
6.1.6
Bug fix where those with a certain WP configuration saw broken links in the back-end.
6.1.5
Now ready for the Simple File List Media extension
** https://wordpress.org/plugins/ee-simple-file-list-media/
Other minor improvements
6.1.4
Added a bunch of new hooks you can use to help make SFL do what you need it to do:
** Uploaded, Added, Removed, Deleted, Edited, Listed, Loaded, Scanned
Improved the function that obtains the current URL of the page for back-end (AJAX) operations.
Fixed a function name conflict issue with the Pro version.
6.1.3
Bug fix where the upload failed to start if non-logged-in user info was not present.
6.1.2
Bug fix where sorting was not working.
Bug fix where upload class was throwing an error.
6.1.1
Added support for the new Simple File List Media extension.
** Go to the new List Settings > Extension Settings tab to access it.
Rewrote the entire upload routine to improve reliability and efficiency.
Now recording file owner Id on back-end uploads too.
File Nice Name option is now available in the edit dialog even if Preserve File Name is OFF.
Improved results messaging, front and back.
Bug fix where if preserving the file name, that name was also used for subsequent files in the upload job.
Bug fix where sorting attributes were not working in the shortcode.
6.0.10
Fixed some low threat XXS vulnerabilities.
6.0.9
Bug fix where files with uppercase extensions which were added outside of the plugin would not create a thumbnail file.
Other minor fixes and improvements.
6.0.8
Cleaned up file manager display by not showing the item owner/submitter information for yourself.
Fixed an issue where item submitter info was being unnecessarily recorded on the back-end.
Took care of some undefined variable notices.
6.0.7
Improved the fail condition if bad file manager directory.
Improved thumbnails display to use the default icon should the source thumb file be missing.
Bug fix where the upload description was missing on the notification message.
6.0.6
Bug fix where leading slash within the FileListDir settings was causing directory read failure.
6.0.5
Bug fix where the footer language selector was not working.
General code improvements.
6.0.4
Added additional shortcode attributes: style and theme
Bug fix where eeSFL_ScrollToIt was not defined.
Bug fix where the file link within the notice email was broken.
6.0.3
Bug Fix where upload form appeared even if turned off.
Bug fix where PHP Warning was thrown on missing array key.
6.0.2
Major UI and code base improvements.
NEW -> Added ability to give a file a “Nice Name”. This displays in place of the real file and can contain characters that are not allowed in file names.
NEW -> Added option to choose from three responsive file manager styles: Table, Tiles or Flex
NEW -> Added option to choose from three theme options: Light, Dark or None.
NEW -> Added option to allow the upload form to appear either above or below the file manager.
NEW -> Added to choose the date type displayed. This shows the selected date type (added or modified) despite the sort settings.
NEW -> Added inputs for customizing the description and file submitter label text.
NEW -> Added an option to bypass the post-upload results page and go straight to the file manager.
NEW -> Added shortcode display with copy-to-clipboard button to admin UI (top-right)
NEW -> Added ability to override the locale setting in order to display English on the back-end list and settings tabs.
Redesigned the File Edit dialog to open in a modal dialog box rather than inline with the file. All changes can be saved at once now.
Improved the upload form to display a list of the files to be uploaded. You can also remove individual files if needed.
Separated the ‘Get Uploader Info’ form settings. Now you can get the description and/or the submitter’s information, rather than only both.
The file manager is now responsive, shifting to a vertical block display on small screens.
Removed the Shortcode Builder. If you need to over-ride existing settings, refer to: https://simplefilelist.com/shortcode/ for a list of attributes.
Now Requires PHP 7 +
See the changelog archive here: https://simplefilelist.com/sfl-base-changelog-archive/
