Description

The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users (when front-end file management is enabled) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the list.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-19T06:17:35.500Z",
  "pubdate": "2026-08-19T06:17:35.500Z",
  "executiveSummary": "A Stored Cross-Site Scripting (XSS) vulnerability exists in the Simple File List WordPress plugin through version 6.3.11. The security flaw stems from the application's failure to properly sanitise and escape file descriptions prior to rendering them within the public file list interface. Consequently, unauthenticated threat actors can inject arbitrary JavaScript payloads into file descriptions when front-end file management is enabled. Successful exploitation allows malicious scripts to execute within the browser context of any site visitor or administrative user viewing the compromised public file list. This exposes the application to risks such as session hijacking, credential theft, and unauthorized actions performed on behalf of the victim. The vulnerability represents a significant risk to data integrity and client-side security, requiring immediate remediation to prevent unauthorized script execution and subsequent compromise of client sessions.",
  "technicalDetails": "The vulnerability is classified as a Stored Cross-Site Scripting (XSS) flaw localized within the Simple File List WordPress plugin affecting versions through 6.3.11. The root cause of the vulnerability resides in insufficient input sanitization and output escaping mechanisms applied to file metadata, specifically the file description field. When a user or automated routine interacts with the application via the front-end file management interface, submitted file descriptions are processed and stored persistently within the database or underlying data structures without adequate neutralization of HTML markup or JavaScript vectors.\nThe exploitation method relies on network exposure where unauthenticated remote attackers can supply malicious input containing executable script tags or event handlers disguised as legitimate file descriptions. This prerequisite is contingent upon the front-end file management feature being enabled within the plugin configuration. The attack flow proceeds as follows: First, the attacker crafts a malicious payload containing JavaScript. Second, the attacker submits this payload through the front-end file management upload or editing interface, where it is persistently stored by the application without proper validation or sanitization. Third, an unsuspecting victim navigates to the public file list page where the vulnerable component retrieves the stored description from the backend database. Fourth, the application dynamically generates the Document Object Model (DOM) and outputs the unescaped file description directly into the HTML response stream without applying context-aware output encoding.\nWhen the victim's browser parses the HTTP response, the injected payload is interpreted as executable code rather than plain text. The payload behavior executes immediately within the security context of the victim's browser session. Depending on the privileges of the victim viewing the public file list, post-exploitation impact can range from the execution of arbitrary client-side actions, theft of sensitive session cookies, DOM manipulation, redirection to malicious infrastructure, or potential privilege escalation if an authenticated administrator views the compromised list. The vulnerability requires network access to the target WordPress instance and relies on the explicit activation of front-end file management capabilities."
}