5.4
Medium
CVE-2024-10146 The Simple File List WordPress plugin before 6.1.13 does not sanitise and escape a generated URL before outputting it…
Description
The Simple File List WordPress plugin before 6.1.13 does not sanitise and escape a generated URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against admins.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Simple File List 6.1 | earliest → < 6.1.13 | 6.1.13 |
| simple_file_list 6.1 | earliest → < 6.1.13 | 6.1.13 |
Other CVEs of Simple File List
The 7 CVEs of Simple File List →
CVE-2026-16617
The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before…
8.8
High
CVE-2026-16616
The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation…
8.6
High
CVE-2023-1025
The Simple File List WordPress plugin before 6.0.10 does not sanitise and escape some of its settings, which could allow…
4.8
Medium
CVE-2022-3207
The Simple File List WordPress plugin before 4.4.12 does not sanitise and escape some of its settings, which could allow…
Not rated