Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

4 records

Vendor: Simplefilelist Component: Simple File List Clear all filters
TI-2020-18982 CVE-2020-36847 · GHSA-34hm-qhxq-8vfv

Simple File List < 4.2.3 - Remote Code Execution

Priority HIGH 82

The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a png extension to use a…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.43519 Published 2025-07-12 Fixed in 4.2.3 CWE-434
TI-2024-09406 CVE-2024-10146 · GHSA-c5rh-2mpx-r3x4

Simple File List < 6.1.13 - Reflected Cross-Site Scripting

Priority MEDIUM 58

The Simple File List WordPress plugin before 6.1.13 does not sanitise and escape a generated URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against admins.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0062 Published 2024-11-14 Fixed in 6.1.13 CWE-79
TI-2023-00970 CVE-2023-1025 · GHSA-gpcv-pffg-3vfg

Simple File List < 6.0.10 - Admin+ Stored XSS

Priority MEDIUM 55

The Simple File List WordPress plugin before 6.0.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unf…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00442 Published 2023-03-27 Fixed in 6.0.10 CWE-79