CVE-2026-16617— Simple File List <= 6.3.11 - Unauthenticated Stored XSS via File Description
Quick assessment
Affected
Unknown Simple File List
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Simple File List WordPress 插件版本 6.3.11 及之前版本在将文件的描述信息输出到公开文件列表前，未进行适当的净化和转义处理。这导致攻击者（在前端文件管理功能启用时，无需身份验证）可注入恶意脚本，从而在访问该公开列表的任何用户的浏览器中执行存储型跨站脚本攻击（Stored XSS）。
Possible ATT&CK Techniques 1 AI
T1059.007 · JavaScriptAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Simple File List | ≤ 6.3.11 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-16617
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Simple File List <= 6.3.11 - Unauthenticated Stored XSS via File Description
Source: CVE Program / CVE List V5
Vulnerability Description
The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users (when front-end file management is enabled) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the list.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Simple File List | 0 ~ 6.3.11 | - |
|
II. Public POCs for CVE-2026-16617
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-16617
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-16617 (1)
-
🔗 Simple File List <= 6.3.11 – Unauthenticated Stored XSS via File Description | CVE 2026-16617 | Plugin Vulnerabilities Read full article exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-08-19 · 38 CVEs total
| CVE-2026-18779 | TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Appointment and Payment Record De | |
| CVE-2026-17565 | Animation Addons for Elementor < 2.7.2 - Unauthenticated Server-Side Request Forgery | |
| CVE-2026-18466 | WP Maps < 4.9.8 - Subscriber+ Unlimited Autoloaded Option Creation | |
| CVE-2026-18051 | W3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write and .htaccess Ove | |
| CVE-2026-18231 | WP Directory Kit < 1.5.7 - Unauthenticated User Email Disclosure via select_2_ajax_user | |
| CVE-2026-18202 | JetEngine < 3.8.14 - Author+ Stored XSS via SVG Upload | |
| CVE-2026-18776 | TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Account Takeover via Multiple AJA | |
| CVE-2026-18778 | TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Customer PII Disclosure via Multi | |
| CVE-2026-18777 | TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Arbitrary Appointment Status Chan | |
| CVE-2026-18937 | Broken Link Checker < 2.4.12 - Unauthenticated RCE via Query Variable Injection | |
| CVE-2026-18031 | TabaPay Gateway <= 1.4.0 - Unauthenticated Account Takeover via Payment Callback | |
| CVE-2026-19055 | ProSolution WP Client < 2.0.11 - Reflected XSS via Multiple Parameters | |
| CVE-2026-19709 | Membership For WooCommerce < 3.1.2 - Unauthenticated Member Data Disclosure via REST Consu | |
| CVE-2026-19056 | ProSolution WP Client < 2.0.11 - Reflected XSS via 'page' Parameter | |
| CVE-2026-19416 | KiviCare < 4.5.4 - Patient+ Cross-Patient Appointment Modification via IDOR | |
| CVE-2026-19406 | Easy Appointments < 4.0.1 - Contributor+ Sensitive Information Disclosure via REST Appoint | |
| CVE-2026-19417 | KiviCare < 4.5.4 - Patient+ Arbitrary Media Attachment Read via IDOR | |
| CVE-2026-19782 | WPS Bidouille < 1.33.5 - Subscriber+ User Email Disclosure via wps_get_users | |
| CVE-2026-19842 | SAML Single Sign On 4.8.85 - 5.4.6 - Unauthenticated Administrator Account Takeover via SA | |
| CVE-2026-14334 | Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stored XSS via SV |
Showing top 20 of 38 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Simple File List
-
CVE-2026-39792
WordPress Simple File List plugin <= 6.3.11 - Arbitrary File -
CVE-2026-16616
Simple File List <= 6.3.11 - Unauthenticated Arbitrary File -
CVE-2026-57382
WordPress Simple File List plugin <= 6.3.8 - Reflected Cross -
CVE-2026-12119
Simple File List <= 6.3.7 - Missing Authorization to Authent -
CVE-2026-11911
Simple File List <= 6.3.7 - Unauthenticated Arbitrary File D
Same vendor: Unknown
-
CVE-2026-86786
Slider Pro <= 1.0.0 - Unauthenticated Sensitive Data Disclos -
CVE-2026-94299
elegro Crypto Payment <= 1.0.1 - Unauthenticated Arbitrary O -
CVE-2026-94270
Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Byp -
CVE-2026-94278
File Media Renamer <= 1.3 - Author+ Arbitrary File Rename vi -
CVE-2026-94271
Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Con
V. Comments for CVE-2026-16617
No comments yet