CVE-2023-1025

CVE-2023-1025 concerns the WordPress plugin Simple File List prior to version 6.0.10. The issue arises from insufficient sanitisation and escaping of certain settings, enabling Stored Cross-Site Scripting (XSS) by high-privilege users (e.g., admin) even when unfiltered_html is disallowed (such as...

CVE-2020-36847

The CVE-2020-36847 entry concerns the WordPress Simple File List plugin (pre-4.2.3). Affected versions up to and including 4.2.2 allow Remote Code Execution via the plugin’s file-renaming logic: an uploaded file could be renamed from a safe PNG extension to PHP and executed on the server. This re...

CVE-2024-10146

The CVE concerns the WordPress plugin Simple File List, versions before 6.1.13. The issue is a reflected XSS caused by a generated URL being output in an attribute without proper sanitisation/escaping, which can execute malicious scripts in an admin’s browser. Exploitation requires the victim to ...

CVE-2023-39924

CVE-2023-39924 affects the WordPress plugin Mitchell Bennis Simple File List (versions