# File Manager Pro – Filester

> Best WordPress file manager without FTP access. Edit code with built-in editor, upload files, download plugins, download themes, manage wp directory, …

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 09:31 UTC.

## Facts (WordPress.org)

- Slug: `filester`
- Author: Ninja Team
- Version: 2.1.5
- Active installs: 100,000+
- Last update: 2026-10-26 (18 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 3.0, PHP any
- Tags: Download Plugin, file manager, ftp, wordpress file manager, wp file manager
- Page: https://wordpress.org/plugins/filester/

## Checks (against WordPress 7.1.4)

- OK: Updated 18 days ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Breaking ↔ Smooth, Inaccessible ↔ Accessible, Behind ↔ Current, Heavy ↔ Light, Pushy ↔ Fair, Closed ↔ Agent-ready.

## Known vulnerabilities

- 2026-09-24 MEDIUM: Reflected Cross-Site Scripting (up to 2.1.2). WF-3bcaa6e3-c789-4859-a514-6b86e799c16d-1, https://www.wordfence.com/threat-intel/vulnerabilities/id/3bcaa6e3-c789-4859-a514-6b86e799c16d?source=api-prod
- 2026-06-15 HIGH: Authenticated Remote Code Execution (before 2.1.1). WF-487185ed-d5ff-4658-9210-958e3ba2fe91-2, https://www.wordfence.com/threat-intel/vulnerabilities/id/487185ed-d5ff-4658-9210-958e3ba2fe91?source=api-prod
- 2025-08-12 MEDIUM: Directory Traversal to Arbitrary File Deletion (up to 1.8.9). WF-c2a166de-3bdf-4883-91ba-655f2757c53b-1, https://www.wordfence.com/threat-intel/vulnerabilities/id/c2a166de-3bdf-4883-91ba-655f2757c53b?source=api-prod
- 2025-06-19 MEDIUM: Authenticated (Administrator+) Stored Cross-Site Scripting (up to 1.8.8). CVE-2025-52710, https://www.wordfence.com/threat-intel/vulnerabilities/id/23fc3221-73b0-4407-a5d7-f145c3dbc1e6?source=api-prod
- 2025-06-13 HIGH: Authenticated (Administrator+) Arbitrary File Upload (up to 1.8.8). CVE-2025-3234, https://www.wordfence.com/threat-intel/vulnerabilities/id/00df02cd-b4d3-477a-86ee-aa2f9b5216e8?source=api-prod
- 2024-12-18 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Filebird Plugin Installation (up to 1.8.6). CVE-2024-12331, https://www.wordfence.com/threat-intel/vulnerabilities/id/5b09bfff-4d6e-4de0-b6ab-6ac27c4f2be6?source=api-prod
- 2024-11-27 HIGH: File Manager Pro – Filester <= 1.8.6- Authenticated (Subscriber+) Arbitrary File Upload (up to 1.8.6). CVE-2024-8066, https://www.wordfence.com/threat-intel/vulnerabilities/id/27288836-e5d3-49fc-b1f6-319ea3b70839?source=api-prod
- 2024-11-27 HIGH: Authenticated (Administrator+) Local JavaScript File Inclusion (up to 1.8.5). CVE-2024-9669, https://www.wordfence.com/threat-intel/vulnerabilities/id/7d947023-60d3-4bd8-b45d-e1663326d6c1?source=api-prod
- 2024-08-02 HIGH: Authenticated Plugin Settings Update (up to 1.8.2). CVE-2024-7031, https://www.wordfence.com/threat-intel/vulnerabilities/id/aef584bd-60a5-4bf2-b8d3-58e3b45e785e?source=api-prod
- 2023-09-19 MEDIUM: Authenticated (Admin+) Stored Cross-Site Scripting (up to 1.8). CVE-2023-4862, https://www.wordfence.com/threat-intel/vulnerabilities/id/927696bd-bf0c-4f15-9b06-21c3d0a11aed?source=api-prod
- 2023-09-19 HIGH: Authenticated (Admin+) Arbitrary File Upload (up to 1.8). CVE-2023-4861, https://www.wordfence.com/threat-intel/vulnerabilities/id/99b2e3c3-b5e5-4648-81c8-da2f42ceec66?source=api-prod
- 2023-09-11 HIGH: Cross-Site Request Forgery to Arbitrary File Rename (up to 1.7.6). CVE-2023-4827, https://www.wordfence.com/threat-intel/vulnerabilities/id/cfbc7af2-1e2c-4aaf-b73c-870f7519aff1?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=filester · HTML: https://todaywp.com/plugins/filester