CVE-2026-57382
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Simple File List WordPress plugin contains a reflected Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. This affects all versions up to and including 6.3.8.
Risk Assessment
An attacker can inject malicious JavaScript code into the page, potentially leading to session hijacking, redirects to malicious sites, or theft of sensitive data.
Recommendation
Immediately update the Simple File List plugin to the latest available version that fixes this vulnerability. If no update is available, temporarily disable the plugin.
Other vulnerabilities in Simple File List
See all- CVE-2026-16617High
The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users (when front-end file management is enabled) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the list.
- CVE-2026-16616High
The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure and potential site takeover.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mitchell Bennis Simple File List simple-file-list allows Reflected XSS.This issue affects Simple File List: from n/a through <= 6.3.8.