CVE-2023-1025

CVE-2023-1025 concerns the WordPress plugin Simple File List prior to version 6.0.10. The issue arises from insufficient sanitisation and escaping of certain settings, enabling Stored Cross-Site Scripting (XSS) by high-privilege users (e.g., admin) even when unfiltered_html is disallowed (such as...

CVE-2020-36847

CVE-2020-36847 affects the WordPress Simple File List plugin (versions ≤ 4.2.2). The vulnerability is Remote Code Execution via the plugin’s file-renaming flow (rename of uploaded PHP disguised as PNG to PHP), allowing unauthenticated code execution on the server. Affected component: Simple File ...

CVE-2024-10146

The CVE concerns the WordPress plugin Simple File List, versions before 6.1.13. The issue is a reflected XSS caused by a generated URL being output in an attribute without proper sanitisation/escaping, which can execute malicious scripts in an admin’s browser. Exploitation requires the victim to ...

CVE-2023-39924

CVE-2023-39924 affects the WordPress plugin Mitchell Bennis Simple File List (versions