← CVE Intelligence

CVE-2026-16617

Simple File List <= 6.3.11 - Unauthenticated Stored XSS via File Description PUBLISHED

Description (CNA)

The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users (when front-end file management is enabled) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the list.

Affected (CNA)

Vendor / productVersions
Unknown / Simple File Listaffected 0 through 6.3.11

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.