CVE-2026-16617
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users (when front-end file management is enabled) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the list.
Risk Assessment
Stored XSS attacks can lead to session theft, admin account takeover, or spreading malicious code among visitors.
Recommendation
Update the Simple File List plugin to version 6.3.12 or later if available, or disable front-end file management.
Original NVD description (English source)
The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users (when front-end file management is enabled) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the list.