Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2026-16617

Simple File List <= 6.3.11 - Unauthenticated Stored XSS via File Description

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users (when front-end file management is enabled) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the list.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown Simple File List

Default version status: unknown

  • 0 to ≤ 6.3.11affected

References