CVE-2022-3208: Simplefilelist Simple-File-List

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

The Simple File List WordPress plugin before 4.4.12 does not implement nonce checks, which could allow attackers to make a logged in admin create new page and change it's content via a CSRF attack.

Affected products

• Simplefilelist Simple-File-List: before 4.4.12 (fixed in 4.4.12)

Published 2022-10-10. Last modified 2026-06-17.