CVE-2026-16617 - Simple File List <= 6.3.11 - Unauthenticated Stored XSS via File Description · CoreCVE

Back Back to CVE browser

HIGH

Simple File List <= 6.3.11 - Unauthenticated Stored XSS via File Description

Published Aug 19, 2026

8.8

HIGH

CVSS 3.1

EPSS 0.51%

Description

The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users (when front-end file management is enabled) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the list.

Affected products

Vendor n/a Product Simple File List Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=6.3.11

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Simple File List

n/a

Version	Status	Constraints
0	affected	<=6.3.11

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (1)

https://wpscan.com/vulnerability/fc51a940-8e67-45d0-b47d-b16da288ebb3/
exploitvdb-entrytechnical-description

Link	Providers	Tags
https://wpscan.com/vulnerability/fc51a940-8e67-45d0-b47d-b16da288ebb3/		exploitvdb-entrytechnical-description

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Aug 19, 2026

Updated Aug 19, 2026

Reserved Jul 22, 2026

Link CVE-2026-16617

CISA Vulnrichment

Updated Aug 19, 2026

Status Deferred

Modified Aug 26, 2026

Link CVE-2026-16617

Severity n/a

Public date n/a

Links CVE-2026-16617

Assigner n/a

Published n/a

Updated n/a

Exploited since n/a

Link n/a