4 matches found
CVE-2020-36847
The CVE-2020-36847 entry concerns the WordPress Simple File List plugin (pre-4.2.3). Affected versions up to and including 4.2.2 allow Remote Code Execution via the plugin’s file-renaming logic: an uploaded file could be renamed from a safe PNG extension to PHP and executed on the server. This re...
CVE-2023-1025
CVE-2023-1025 concerns the WordPress plugin Simple File List prior to version 6.0.10. The issue arises from insufficient sanitisation and escaping of certain settings, enabling Stored Cross-Site Scripting (XSS) by high-privilege users (e.g., admin) even when unfiltered_html is disallowed (such as...
CVE-2024-10146
The Simple File List WordPress plugin (versions prior to 6.1.13 ) is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw. The root cause is the failure to sanitise and escape a generated URL before outputting it back into an attribute. An attacker could exploit this to execute malicious scr...