simplefilelist Vulnerabilities and Affected Products
Explore source-attributed vulnerabilities associated with simplefilelist products.
Products
- simple_file_list2 vulnerabilities
- simple-file-list1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2020-36847CRITICAL | Simple File List < 4.2.3 - Remote Code ExecutionThe Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a png extension to use a php extension. This allows unauthenticated attackers to execute code on the server. CWE-434Jul 12, 2025 | CVSS9.8v3.1 | EPSS18% | PoCs2 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-10146MEDIUM | Simple File List < 6.1.13 - Reflected Cross-Site ScriptingThe Simple File List WordPress plugin before 6.1.13 does not sanitise and escape a generated URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against admins. | CVSS5.4v3.1 | EPSS0.57% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2020-12832CRITICAL | simplefilelist simple-file-list Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')WordPress Plugin Simple File List before 4.2.8 is prone to a vulnerability that lets attackers delete arbitrary files because the application fails to properly verify user-supplied input. | CVSS9.8v3.1 | EPSS7.13% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |