WordPress Plugin Vulnerabilities

Simple File List <= 6.3.11 - Unauthenticated Stored XSS via File Description

Description

The plugin does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users (when front-end file management is enabled) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the list.

Proof of Concept

Affects Plugins

Plugin icon
simple-file-list
No known fix

References

CVE
CVE-2026-16617

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
8.8 (high)

Miscellaneous

Original Researcher
Ruwantha Harshamal
Submitter
Ruwantha Harshamal
Submitter website
https://www.ruwanthaharshamal.com/
Verified
Yes
WPVDB ID
fc51a940-8e67-45d0-b47d-b16da288ebb3

Timeline

Publicly Published
2026-08-17 (about 3 days ago)
Added
2026-08-17 (about 2 days ago)
Last Updated
2026-08-19 (about 9 hours ago)

Other

Published
Title
Published
2021-03-17
Title
Elementor < 3.1.4 - Authenticated Stored Cross-Site Scripting (XSS) in Heading Widget
Published
2025-09-09
Title
Football Pool < 2.13.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2012-01-01
Title
WP Live.php <= 1.2.1 - Cross-Site Scripting (XSS)
Published
2025-12-12
Title
JetWidgets For Elementor < 1.0.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison and Subscribe Widgets
Published
2024-11-08
Title
Tigris Flexplatform <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting