CVE-2022-3062: Simple File List < 4.4.12 - Reflected Cross-Site Scripting

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 44.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-09-26 · updated 2026-06-17
Weakness: CWE-79

Description

The Simple File List WordPress plugin before 4.4.12 does not escape parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting

Affected products

Simple File List: before 4.4.12 — fixed in 4.4.12

How to fix

Upgrade to a fixed version: Simple File List 4.4.12. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/2e829bbe-1843-496d-a852-4150fa6d1f7a
https://wpscan.com/vulnerability/2e829bbe-1843-496d-a852-4150fa6d1f7a

Get alerted when CVE-2022-3062 or the next vulnerability affects your stack