Known vulnerabilities in Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager

Create unlimited folders with the Folders WordPress plugin, organize & manage your Media Library files, Pages & Posts in folders 📁

8Reported vulnerabilities

8.8Highest CVSS score

3.1.9Latest version

90,000+Active installs

What to do now

Update Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager to 3.1.6 or later. 8 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 13, 2026 / Tested up to WordPress: 7.1 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2024-2024	High 8.8	3.3%	0 to 3.0.2 (inclusive)	`3.0.3`	June 14, 2024
CVE-2023-40204	High 8.8	0.8%	2.9.2 and earlier	`2.9.3`	August 28, 2023
WF-35afef52-350c-4b61-b9c0-3ae2572f81fb	High 8.8	—	Before 2.9.3	`2.9.3`	August 25, 2023
CVE-2024-7317	Medium 5.4	0.4%	Before 3.0.4	`3.0.4`	August 6, 2024
CVE-2024-3868	Medium 5.4	0.4%	3.0.2 and earlier	`3.0.3`	May 3, 2024
CVE-2024-2023	Medium 4.3	0.7%	0 to 3.0 (inclusive) 0 to 3.0.2 (inclusive) 0 to 3.0 (inclusive) 0 to 3.0.2 (inclusive)	`3.0.1`	June 14, 2024
CVE-2025-12640	Medium 4.3	0.2%	0 to 3.1.5 (inclusive)	`3.1.6`	January 8, 2026
CVE-2025-12971	Medium 4.3	0.2%	0 to 3.1.5 (inclusive)	`3.1.6`	November 27, 2025

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.