8.8
High
CVE-2026-16617 The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before…
Description
The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users (when front-end file management is enabled) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the list.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Simple File List 6.3 | earliest → 6.3.11 | No fix stated |
Other CVEs of Simple File List
The 7 CVEs of Simple File List →
CVE-2026-16616
The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation…
8.6
High
CVE-2024-10146
The Simple File List WordPress plugin before 6.1.13 does not sanitise and escape a generated URL before outputting it…
5.4
Medium
CVE-2023-1025
The Simple File List WordPress plugin before 6.0.10 does not sanitise and escape some of its settings, which could allow…
4.8
Medium
CVE-2022-3207
The Simple File List WordPress plugin before 4.4.12 does not sanitise and escape some of its settings, which could allow…
Not rated