CVE-2026-16617 in Simple File List Plugin
Summary
by MITRE • 08/19/2026
The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users (when front-end file management is enabled) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the list.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified within the Simple File List WordPress plugin versions up to 6.3.11 represents a critical security flaw rooted in inadequate input validation and output encoding mechanisms. Specifically, the application fails to properly sanitize or escape file descriptions before rendering them on public-facing pages that display lists of uploaded files. This deficiency allows malicious actors to inject executable script payloads into these description fields during the upload process. Because the data is stored directly in the database without sufficient sanitization and subsequently rendered as raw HTML content rather than being escaped, it bypasses standard browser security filters designed to prevent code execution from untrusted sources.
This architectural weakness facilitates Stored Cross-Site Scripting attacks, which are classified under CWE-79 in the Common Weakness Enumeration framework. Unlike reflected XSS where malicious scripts are executed immediately via a crafted link, stored vulnerabilities persist on the target server. In this specific context, when front-end file management is enabled, unauthenticated users can upload files with malicious descriptions. These payloads remain active until manually removed by an administrator or until the affected file is deleted. Consequently, every visitor who accesses the public file list becomes a potential victim of the attack as their browser executes the injected JavaScript code in the context of the vulnerable website.
The operational impact of this vulnerability extends beyond simple script execution. Attackers can leverage stored XSS to perform session hijacking by stealing authentication cookies or tokens from users viewing the page, potentially leading to unauthorized access to administrative accounts if those sessions are active on the same domain. Furthermore, attackers may redirect victims to phishing sites designed to harvest credentials or deploy malware through drive-by download techniques. The persistence of this payload means that a single successful injection can compromise numerous visitors over an extended period without requiring further interaction from the attacker, significantly amplifying the severity and scope of the breach compared to transient vulnerabilities.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1059.007, which covers JavaScript execution within web browsers as part of client-side code injection tactics. The attack vector relies on social engineering or automated upload scripts to introduce the malicious content, followed by passive exploitation when users interact with the compromised page elements. This behavior is characteristic of persistent threats aiming for long-term access and data exfiltration rather than immediate disruption.
Mitigation strategies must address both the technical flaw and the configuration settings that expose it. The primary remediation involves upgrading to a patched version of the Simple File List plugin where developers have implemented robust input sanitization using functions such as wp_kses or similar WordPress-specific escaping mechanisms before outputting data to the browser. Additionally, administrators should enforce strict Content Security Policy headers to restrict inline script execution, providing an additional layer of defense even if code injection occurs. It is also advisable to disable front-end file management for unauthenticated users unless absolutely necessary, thereby removing the attack vector entirely by restricting upload capabilities to authenticated and trusted individuals only. Regular security audits and penetration testing should be conducted to identify similar sanitization gaps across other plugins and custom themes within the WordPress ecosystem.