CVE-2026-16617: Unknown Simple File List

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users (when front-end file management is enabled) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the list.

Affected products

• Unknown Simple File List: up to and including 6.3.11

Published 2026-08-19. Last modified 2026-08-26.