CVE-2026-16617— Simple File List <= 6.3.11 - Unauthenticated Stored XSS via File Description
Possible ATT&CK Techniques 1AI
T1059.007 · JavaScriptAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Simple File List | ≤ 6.3.11 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-16617
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Simple File List <= 6.3.11 - Unauthenticated Stored XSS via File Description
Source: CVE Program / CVE List V5
Vulnerability Description
The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users (when front-end file management is enabled) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the list.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Simple File List | 0 ~ 6.3.11 | - |
II. Public POCs for CVE-2026-16617
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-16617
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-16617 (1)
- 🔗 Simple File List <= 6.3.11 – Unauthenticated Stored XSS via File Description | CVE 2026-16617 | Plugin Vulnerabilities Read full article exploitvdb-entrytechnical-description
Same Patch Batch · Unknown · 2026-08-19 · 38 CVEs total
| CVE-2026-14826 | Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Email and Results Configuration | |
| CVE-2026-18031 | TabaPay Gateway <= 1.4.0 - Unauthenticated Account Takeover via Payment Callback | |
| CVE-2026-17565 | Animation Addons for Elementor < 2.7.2 - Unauthenticated Server-Side Request Forgery | |
| CVE-2026-15253 | Easy Media Replace <= 0.2.0 - Author+ Stored XSS via Attachment Title | |
| CVE-2026-16058 | YayCurrency < 3.3.5 - Unauthenticated Order and Vendor Financial Data Disclosure via Dokan | |
| CVE-2026-16570 | NextScripts: Social Networks Auto-Poster < 4.4.8 - Reflected XSS via Facebook OAuth Callba | |
| CVE-2026-16616 | Simple File List <= 6.3.11 - Unauthenticated Arbitrary File Read and Move via Path Travers | |
| CVE-2026-14825 | Quiz And Survey Master < 11.2.4 - Contributor+ Arbitrary Quiz Text Settings Update via IDO | |
| CVE-2026-14334 | Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stored XSS via SV | |
| CVE-2026-14861 | User Verification <= 2.0.47 - Unauthenticated Arbitrary Account Lockout via IDOR | |
| CVE-2026-16979 | SmartCrawl < 3.16.3 - Subscriber+ Private/Draft Post Title Disclosure and Post Meta Key En | |
| CVE-2026-14287 | TenWeb Speed Optimizer < 2.33.5 - Unauthenticated Stored XSS via Critical CSS Token Bypass | |
| CVE-2026-14196 | WCFM Marketplace < 3.8.1 - Store Vendor+ Cross-Vendor Review Deletion and Status Update vi | |
| CVE-2026-13174 | Eventin < 4.1.21 - Contributor+ Speaker Account Deletion via IDOR | |
| CVE-2026-13175 | Eventin < 4.1.21 - Contributor+ Schedule Deletion and Modification via IDOR | |
| CVE-2026-11565 | Advanced File Manager < 5.4.13 - Authenticated Arbitrary File Read and Write via fma_load_ | |
| CVE-2026-12983 | Dinatur <= 1.18 - Unauthenticated SQL Injection via Column Name Injection | |
| CVE-2026-13169 | Eventin < 4.1.21 - Contributor+ Arbitrary Event Modification, Deletion and Ownership Takeo | |
| CVE-2026-13173 | Eventin < 4.1.21 - Contributor+ User Role and Meta Modification via Speaker Creation | |
| CVE-2026-18777 | TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Arbitrary Appointment Status Chan |
Showing top 20 of 38 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Simple File List
- CVE-2026-16616
Simple File List <= 6.3.11 - Unauthenticated Arbitrary File - CVE-2026-57382
WordPress Simple File List plugin <= 6.3.8 - Reflected Cross - CVE-2026-12119
Simple File List <= 6.3.7 - Missing Authorization to Authent - CVE-2026-11911
Simple File List <= 6.3.7 - Unauthenticated Arbitrary File D - CVE-2026-11912
Simple File List <= 6.3.7 - Missing Authorization to Unauthe
Same vendor: Unknown
- CVE-2026-75860
JSON Options <= 0.0.4 - Unauthenticated Arbitrary Options Up - CVE-2026-74992
Kirki < 6.2.3 - Editor+ Stored XSS via Font Zip Upload - CVE-2026-19699
GutenKit 2.4.12 - 2.4.15 - Contributor+ Mailchimp Audience D - CVE-2026-19615
Admin and Site Enhancements < 9.0.1 - Author+ Stored XSS via - CVE-2026-19697
GutenKit < 2.5.0 - Author+ Stored XSS via SVG Upload
V. Comments for CVE-2026-16617
No comments yet