Simple File List
Approved changes feed: RSS · Atom
cpe:2.3:a:simplefilelist:simple_file_list:*:*:*:*:*:wordpress:*:*
part: a version: * update: *
| Vendor | Simplefilelist (eab7a3eb-72ea-5ccb-a35c-71d74118eeb4) |
|---|---|
| Product | Simple File List (ddb619ab-053f-5223-96eb-322543ae8720) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | wordpress |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/wpplugins/simple-file-list |
purl2cpe | 2026-06-01 10:14:56.594789 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-10146 |
vulnerable | 2026-06-08 06:22:03.668653 |
Simple File List < 6.1.13 - Reflected Cross-Site Scripting
The Simple File List WordPress plugin before 6.1.13 does not sanitise and escape a generated URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against admins.
Published: 2024-11-14T06:00:06.865Z
Updated: 2024-11-14T18:50:53.614Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-39924 |
vulnerable | 2026-06-08 06:09:38.110658 |
WordPress Simple File List Plugin <= 6.1.9 is vulnerable to Cross Site Scripting (XSS)
MEDIUM (5.9)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mitchell Bennis Simple File List plugin <= 6.1.9 versions.
Published: 2023-10-24T11:51:07.312Z
Updated: 2026-04-28T16:08:35.205Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-1025 |
vulnerable | 2026-06-08 05:52:33.658784 |
Simple File List < 6.0.10 - Admin+ Stored XSS
The Simple File List WordPress plugin before 6.0.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Published: 2023-03-27T15:37:42.298Z
Updated: 2025-02-26T21:05:54.904Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-36847 |
vulnerable | 2026-06-08 05:25:49.650561 |
Simple File List < 4.2.3 - Remote Code Execution
CRITICAL (9.8)
The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a png extension to use a php extension. This allows unauthenticated attackers to execute code on the server.
Published: 2025-07-12T09:24:28.215Z
Updated: 2026-04-08T17:11:48.634Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.