CVE-2024-10146 – Simple File List < 6.1.13 - Reflected Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2024-10146

24 Oct 2024 — The Simple File List WordPress plugin before 6.1.13 does not sanitise and escape a generated URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against admins. The Simple File List plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via a URL in all versions up to, and including, 6.1.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in... • https://wpscan.com/vulnerability/9ee74a0f-83ff-4c15-a114-f8f6baab8bf5 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •