CVE-2026-57382

Simple File List <= 6.3.8 - Reflected Cross-Site Scripting

mediumImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

6.1

CVSS Score

6.1

CVSS Score

medium

Severity

6.3.9

Patched in

Time to patch

Description

The Simple File List plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 6.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Low

Confidentiality

Low

Integrity

None

Availability

Technical Details

Affected versions<=6.3.8

PublishedJuly 7, 2026

Last updatedJuly 14, 2026

Affected pluginsimple-file-list

What Changed in the Fix

Changes introduced in v6.3.9

Loading patch diff...

Source Code

WordPress.org SVN

Vulnerable v6.3.8

Browse source Download .zip

Patched v6.3.9

Browse source Download .zip

Research Plan

Unverified

# Exploitation Research Plan: CVE-2026-57382 (Simple File List) ## 1. Vulnerability Summary The **Simple File List** plugin for WordPress (versions <= 6.3.8) is vulnerable to **Reflected Cross-Site Scripting (XSS)**. The vulnerability exists due to insufficient sanitization and output escaping of u…

Show full research plan

Exploitation Research Plan: CVE-2026-57382 (Simple File List)

1. Vulnerability Summary

The Simple File List plugin for WordPress (versions <= 6.3.8) is vulnerable to Reflected Cross-Site Scripting (XSS). The vulnerability exists due to insufficient sanitization and output escaping of user-supplied parameters within the file list display logic. Specifically, URL parameters used for navigation and list management are reflected back into the page (either in HTML or within script tags) without proper neutralization, allowing unauthenticated attackers to execute arbitrary JavaScript in the context of the victim's browser session.

2. Attack Vector Analysis

Vulnerable Endpoint: Any page or post containing the [eeSFL] shortcode.
Vulnerable Parameter: eeURL (inferred from JS redirect) or folder/navigation parameters like eeSFL_ArchivePath.
Authentication: None (Unauthenticated).
Preconditions: The plugin must be active and the [eeSFL] shortcode must be placed on a publicly accessible page.
Payload Type: Tag-based breakout or JavaScript string breakout.

3. Code Flow

Entry Point: An unauthenticated user visits a page containing the [eeSFL] shortcode with malicious query parameters (e.g., ?eeSFL_ArchivePath=1&eeSFL_ArchiveListID=1&payload=...).

Research Findings

Static analysis — not yet PoC-verified

Summary

The Simple File List plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the interpolation of user-influenced variables into a script block. Attackers can execute arbitrary JavaScript by crafting URLs with malicious payloads that break out of the JavaScript string context in the front-end file list view.

Vulnerable Code

// includes/ee-list-display.php line 291
<span class="eeHide" id="eeSFL_ID">' . $eeSFL->eeListID . '</span>

<script>
	var eeSFL_ThisURL = "' . $eeURL . '";
	var eeSFL_ListID = ' . $eeSFL->eeListID . ';
	var eeSFL_PluginURL = "' . $eeSFL->eeEnvironment['pluginURL'] . '";
	var eeSFL_FileListDir = "' . $eeSFL->eeListSettings['FileListDir'] . '";
	var eeSFL_SubFolder = "' . eeSFL_NormalizeSlashes($eeSFL->eeCurrentFolder) . '";
	var eeSFL_ShortcodeFolder = "' . eeSFL_NormalizeSlashes($eeSFL->eeShortcodeFolder) . '";
	var eeSFL_ShowListStyle = "' . $eeSFL->eeListSettings['ShowListStyle'] . '";
</script>

Security Fix

--- /home/deploy/wp-safety.org/data/plugin-versions/simple-file-list/6.3.8/includes/ee-list-display.php	2026-06-09 18:19:22.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/simple-file-list/6.3.9/includes/ee-list-display.php	2026-06-22 14:41:48.000000000 +0000
@@ -291,13 +291,13 @@
 <span class="eeHide" id="eeSFL_ID">' . $eeSFL->eeListID . '</span>
 
 <script>
-	var eeSFL_ThisURL = "' . $eeURL . '";
+	var eeSFL_ThisURL = "' . esc_js($eeURL) . '";
 	var eeSFL_ListID = ' . $eeSFL->eeListID . ';
-	var eeSFL_PluginURL = "' . $eeSFL->eeEnvironment['pluginURL'] . '";
-	var eeSFL_FileListDir = "' . $eeSFL->eeListSettings['FileListDir'] . '";
-	var eeSFL_SubFolder = "' . eeSFL_NormalizeSlashes($eeSFL->eeCurrentFolder) . '";
-	var eeSFL_ShortcodeFolder = "' . eeSFL_NormalizeSlashes($eeSFL->eeShortcodeFolder) . '";
-	var eeSFL_ShowListStyle = "' . $eeSFL->eeListSettings['ShowListStyle'] . '";
+	var eeSFL_PluginURL = "' . esc_js($eeSFL->eeEnvironment['pluginURL']) . '";
+	var eeSFL_FileListDir = "' . esc_js($eeSFL->eeListSettings['FileListDir']) . '";
+	var eeSFL_SubFolder = "' . esc_js(eeSFL_NormalizeSlashes($eeSFL->eeCurrentFolder)) . '";
+	var eeSFL_ShortcodeFolder = "' . esc_js(eeSFL_NormalizeSlashes($eeSFL->eeShortcodeFolder)) . '";
+	var eeSFL_ShowListStyle = "' . esc_js($eeSFL->eeListSettings['ShowListStyle']) . '";
 </script>

Exploit Outline

1. Identify a WordPress page or post containing the `[eeSFL]` shortcode. 2. Construct a malicious URL targeting this page. The payload should target query parameters that are included in the `$eeURL` variable, which is derived from the current request URL. 3. Use a breakout payload such as `";alert(1);//` to terminate the intended JavaScript string and execute arbitrary code. 4. Entice a site visitor or administrator to click the malicious link. 5. When the page loads, the plugin echoes the unescaped URL into an inline `<script>` block, triggering the execution of the injected JavaScript in the victim's browser session.

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/121c8bcd-ebfd-4e2f-8417-836db846b5a4?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database