CVE-2026-16617
Received Received - Intake

Stored XSS in Simple File List WordPress Plugin

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: WPScan

Description
The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users (when front-end file management is enabled) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the list.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-16617
EUVD
EUVD-2026-62272

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
simple_file_list simple_file_list to 6.3.11 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stored Cross-Site Scripting (XSS) flaw in the Simple File List WordPress plugin versions up to 6.3.11. It occurs because the plugin does not properly sanitize file descriptions before displaying them in the public file list. When front-end file management is enabled, unauthenticated users can inject malicious scripts into these descriptions, which then execute in the browsers of visitors viewing the list.

Detection Guidance

Check if the Simple File List WordPress plugin version 6.3.11 or earlier is installed. Inspect file descriptions in the public file list for any suspicious scripts or unusual content. Use browser developer tools to monitor network requests and responses for injected scripts.

Impact Analysis

This vulnerability allows attackers to inject malicious scripts into file descriptions. When visitors view the file list, these scripts can execute in their browsers, potentially stealing session cookies, redirecting users to malicious sites, or performing actions on behalf of the user without their consent.

Compliance Impact

This vulnerability could lead to data breaches by allowing attackers to steal sensitive user data, which may violate GDPR and HIPAA compliance requirements. Organizations using the affected plugin may face legal penalties, reputational damage, and loss of trust due to unauthorized data exposure.

Mitigation Strategies

Disable the Simple File List plugin immediately if front-end file management is enabled. Update to the latest version if a patch becomes available. Implement input validation and output encoding for file descriptions. Monitor for any signs of exploitation in server logs or user reports.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16617. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart