What’s Vulnerable › Vulnerabilities
CVE-2026-16617: Simple File List <= 6.3.11 - Unauthenticated Stored XSS via File Description
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-19 · updated 2026-10-22
- Weakness: CWE-79
Description
The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users (when front-end file management is enabled) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the list.
Affected products
- Simple File List: through 6.3.11
References
Get alerted when CVE-2026-16617 or the next vulnerability affects your stack