CVE-2020-36847

The CVE-2020-36847 entry concerns the WordPress Simple File List plugin (pre-4.2.3). Affected versions up to and including 4.2.2 allow Remote Code Execution via the plugin’s file-renaming logic: an uploaded file could be renamed from a safe PNG extension to PHP and executed on the server. This re...

CVE-2023-1025

CVE-2023-1025 concerns the WordPress plugin Simple File List prior to version 6.0.10. The issue arises from insufficient sanitisation and escaping of certain settings, enabling Stored Cross-Site Scripting (XSS) by high-privilege users (e.g., admin) even when unfiltered_html is disallowed (such as...

CVE-2024-10146

The Simple File List WordPress plugin (versions before 6.1.13 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape a generated URL before outputting it into an attribute. An attacker can exploit this to execute malicious scripts i...