CVE-2022-3062

MEDIUMNuclei

Simple File List < 4.4.12 - Reflected Cross-Site Scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-3062 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Simple File List WordPress plugin before 4.4.12 does not escape parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated May 22, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Simple File List

CVE List4.4.12 to < 4.4.12affected

Nuclei templates

1
ProjectDiscoveryMEDIUMSimple File List < 4.4.12 - Cross Site ScriptingCVSS 6.1

The plugin does not escape parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Fixed in version 4.4.12

WeaknessesCWE-79
Authorsr3Y3r53
Template tagscvecve2022authenticatedwordpresswp-pluginwpwpscanxsssimple-file-listsimplefilelistvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:simplefilelist:simple-file-list:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/2e829bbe-1843-496d-a852-4150fa6d1f7a https://nvd.nist.gov/vuln/detail/CVE-2022-3062 https://wordpress.org/plugins/simple-file-list/ https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

2