CVE-2026-16617 — Simple File List <= 6.3.11 - Unauthenticated Stored XSS via File Description
The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenti…
Published: 2026-08-19 · CVSS: 8.8 · CVSS 3.1
The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users (when front-end file management is enabled) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the list.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7