8.8
Élevée
CVE-2026-16617 The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before…
Description
The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users (when front-end file management is enabled) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the list.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Simple File List 6.3 | premières → 6.3.11 | Pas de correctif indiqué |
Autres CVE de Simple File List
Les 7 CVE de Simple File List →
CVE-2026-16616
The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation…
8.6
Élevée
CVE-2024-10146
The Simple File List WordPress plugin before 6.1.13 does not sanitise and escape a generated URL before outputting it…
5.4
Moyenne
CVE-2023-1025
The Simple File List WordPress plugin before 6.0.10 does not sanitise and escape some of its settings, which could allow…
4.8
Moyenne
CVE-2022-3207
The Simple File List WordPress plugin before 4.4.12 does not sanitise and escape some of its settings, which could allow…
Non notée