Read the docs

Simplefilelist

Records9All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

Simplefilelist records in CISA KEV

No Simplefilelist vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Simple-file-list 5 records MEDIUM Simple File List 4 records HIGH

Records

4 records in Simple File List · all components

TI-2020-18982 CVE-2020-36847 · GHSA-34hm-qhxq-8vfv

Simple File List < 4.2.3 - Remote Code Execution

Priority HIGH 82

The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a png extension to use a…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.43519 Published 2025-07-12 Fixed in 4.2.3 CWE-434
TI-2024-09406 CVE-2024-10146 · GHSA-c5rh-2mpx-r3x4

Simple File List < 6.1.13 - Reflected Cross-Site Scripting

Priority MEDIUM 58

The Simple File List WordPress plugin before 6.1.13 does not sanitise and escape a generated URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against admins.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0062 Published 2024-11-14 Fixed in 6.1.13 CWE-79
TI-2023-00970 CVE-2023-1025 · GHSA-gpcv-pffg-3vfg

Simple File List < 6.0.10 - Admin+ Stored XSS

Priority MEDIUM 55

The Simple File List WordPress plugin before 6.0.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unf…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00442 Published 2023-03-27 Fixed in 6.0.10 CWE-79
Open these records in search →