SHSelfHostIndex
GE

GetSimple CMS

XML-based flat-file CMS for small websites

Content Management Systems ★ 418 stars Easy setup GPL-3.0

GetSimple CMS is a flat-file content management system that stores content as XML files rather than using a database. It is designed for small, simple websites with a straightforward admin interface.

Official siteSource code

Key features

  • XML flat-file storage
  • Simple admin panel
  • Plugin support
  • Built-in backups

Pros & cons

Strengths

  • No database to maintain
  • Easy for small sites

Trade-offs

  • Aging codebase
  • Not for large sites

Is GetSimple CMS secure?

3 known vulnerabilities affect GetSimple CMS's latest release (v3.3.16) according to OSV.dev; the most severe is rated high.

Affecting v3.3.16

AdvisorySeveritySummary
CVE-2022-41544HighGetSimple CMS v3.3.16 was discovered to contain a remote code execution (RCE) vulnerability via the edited_file parameter in admin/theme-edit.php.
CVE-2020-23839MediumA Reflected Cross-Site Scripting (XSS) vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webpage, allows remote attackers to execute JavaScript code in the client's browse...
CVE-2020-24861MediumGetSimple CMS 3.3.16 allows in parameter 'permalink' on the Settings page persistent Cross Site Scripting which is executed when you create and open a new page
4 unconfirmed matches

OSV.dev links these advisories to this release, but their own version data doesn't confirm it: they cover a separately versioned sub-package of the repository, or record the fix only as a commit. They are listed for completeness and not counted in the health score.

Matched by OSV, not confirmed

AdvisorySeveritySummary
CVE-2024-11125MediumGetSimpleCMS profile.php cross-site request forgery
CVE-2021-36601MediumGetSimpleCMS 3.3.16 contains a cross-site Scripting (XSS) vulnerability, where Function TSL does not filter check settings.php Website URL: "siteURL" parameter.
CVE-2023-51246MediumA Cross Site Scripting (XSS) vulnerability in GetSimple CMS 3.3.16 exists when using Source Code Mode as a backend user to add articles via the /admin/edit.php page.
CVE-2023-6188MediumGetSimpleCMS theme-edit.php code injection
  • Most recent fixed advisory CVE-2021-28976, published 2021-06-23 (1939 days ago), fixed in 3.3.15

Source: OSV.dev, checked 2026-10-14. How this is measured.

GetSimple CMS replaces

Self-hosted WordPress alternatives

Health badge

Maintain GetSimple CMS? Add its health score to your README. The badge links back to this page.

SelfHostIndex: 11 · at risk

Markdown
[![SelfHostIndex health score for GetSimple CMS](https://selfhostindex.com/badge/getsimple-cms.svg)](https://selfhostindex.com/app/getsimple-cms/)
HTML
<a href="https://selfhostindex.com/app/getsimple-cms/"><img src="https://selfhostindex.com/badge/getsimple-cms.svg" alt="SelfHostIndex health score for GetSimple CMS"></a>
reStructuredText
.. image:: https://selfhostindex.com/badge/getsimple-cms.svg
   :alt: SelfHostIndex health score for GetSimple CMS
   :target: https://selfhostindex.com/app/getsimple-cms/

The score is recomputed on every nightly rebuild from public repository data — see how it is calculated.

Similar content management systems apps