CVE-2026-16617
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users (when front-end file management is enabled) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the list.
Risk Assessment
Stored XSS attacks can lead to session theft, admin account takeover, or spreading malicious code among visitors.
Recommendation
Update the Simple File List plugin to version 6.3.12 or later if available, or disable front-end file management.
Other vulnerabilities in Simple File List
See all- CVE-2026-39792High
The Simple File List plugin in versions up to 6.3.11 contains an Arbitrary File Deletion vulnerability. The vulnerability can be exploited by an unauthenticated attacker.
- CVE-2026-16616High
The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure and potential site takeover.
- CVE-2026-57382High
The Simple File List WordPress plugin contains a reflected Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. This affects all versions up to and including 6.3.8.
- CVE-2025-68591Medium
Missing Authorization vulnerability in Simple File List (through version 6.1.18) allows exploiting incorrectly configured access control security levels.
Original NVD description (English source)
The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users (when front-end file management is enabled) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the list.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS