CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2023-39924 – WordPress Simple File List Plugin <= 6.1.9 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-39924
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mitchell Bennis Simple File List plugin <= 6.1.9 versions. Vulnerabilidad de Cross-Site Scripting (XSS) Almacenado autenticado (con permisos de admin o superiores) en el complemento Mitchell Bennis Simple File List en versiones <= 6.1.9. The Simple File List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in versions up to, and including, 6.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://patchstack.com/database/vulnerability/simple-file-list/wordpress-simple-file-list-plugin-6-1-9-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-1025 – Simple File List < 6.0.10 - Admin+ Stored XSS
https://notcve.org/view.php?id=CVE-2023-1025
The Simple File List WordPress plugin before 6.0.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). The Simple File List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 6.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. • https://wpscan.com/vulnerability/13621b13-8d31-4214-a665-cb15981f3ec1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2022-3207 – Simple File List < 4.4.12 - Admin+ Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2022-3207
The Simple File List WordPress plugin before 4.4.12 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) El plugin Simple File List de WordPress versiones anteriores a 4.4.12, no sanea y escapa de algunas de sus configuraciones, lo que podría permitir a usuarios con altos privilegios, como el administrador, llevar a cabo ataques de tipo Cross-Site Scripting Almacenado incluso cuando la capacidad unfiltered_html no está permitida (por ejemplo, en una configuración multisitio) The Simple File List plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' and 'subtab' parameters in versions up to, and including, 4.4.11 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. • https://wpscan.com/vulnerability/b57272ea-9a8a-482a-bbaa-5f202ca5b9aa • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-3208 – Simple File List < 4.4.13 - Page Creation via CSRF
https://notcve.org/view.php?id=CVE-2022-3208
The Simple File List WordPress plugin before 4.4.12 does not implement nonce checks, which could allow attackers to make a logged in admin create new page and change it's content via a CSRF attack. El plugin Simple File List de WordPress versiones anteriores a 4.4.12, no implementa comprobaciones de nonce, lo que podría permitir a atacantes hacer que un administrador conectado cree una nueva página y cambie su contenido por medio de un ataque de tipo CSRF The Simple File List plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.4.12. This is due to missing or incorrect nonce validation on its page creation function eeSFL_FREE_CreatePostwithShortcode(). This makes it possible for unauthenticated attackers to create new pages and manipulate their contents, via forged request granted they can trick a site administrator into performing an action such as clicking on a link. • https://wpscan.com/vulnerability/80d475ca-b475-4789-8eef-9c4d880853b7 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2022-3062 – Simple File List < 4.4.12 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2022-3062
The Simple File List WordPress plugin before 4.4.12 does not escape parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting El plugin Simple File List de WordPress versiones anteriores a 4.4.12, no escapa los parámetros antes de devolverlos en atributos, conllevando a un ataque de tipo Cross-Site Scripting Reflejado. The Simple File List plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ and 'subtab' parameters in versions up to, and including, 4.4.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. • https://wpscan.com/vulnerability/2e829bbe-1843-496d-a852-4150fa6d1f7a • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •