[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fF7-Hky9v8i9_Ng7ObYlQKQuXrmhF8_nfeI_EmTeWxO0":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":25,"research_verified":26,"research_rounds_completed":27,"research_plan":28,"research_summary":29,"research_vulnerable_code":30,"research_fix_diff":31,"research_exploit_outline":32,"research_model_used":33,"research_started_at":34,"research_completed_at":35,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":26,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":26,"source_links":36},"CVE-2026-57382","simple-file-list-reflected-cross-site-scripting-4","Simple File List \u003C= 6.3.8 - Reflected Cross-Site Scripting","The Simple File List plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 6.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.","simple-file-list",null,"\u003C=6.3.8","6.3.9","medium",6.1,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-07 00:00:00","2026-07-14 19:47:39",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F121c8bcd-ebfd-4e2f-8417-836db846b5a4?source=api-prod",8,[22,23,24],"includes\u002Fee-list-display.php","readme.txt","simple-file-list.php","researched",false,3,"# Exploitation Research Plan: CVE-2026-57382 (Simple File List)\n\n## 1. Vulnerability Summary\nThe **Simple File List** plugin for WordPress (versions \u003C= 6.3.8) is vulnerable to **Reflected Cross-Site Scripting (XSS)**. The vulnerability exists due to insufficient sanitization and output escaping of user-supplied parameters within the file list display logic. Specifically, URL parameters used for navigation and list management are reflected back into the page (either in HTML or within script tags) without proper neutralization, allowing unauthenticated attackers to execute arbitrary JavaScript in the context of the victim's browser session.\n\n## 2. Attack Vector Analysis\n*   **Vulnerable Endpoint:** Any page or post containing the `[eeSFL]` shortcode.\n*   **Vulnerable Parameter:** `eeURL` (inferred from JS redirect) or folder\u002Fnavigation parameters like `eeSFL_ArchivePath`.\n*   **Authentication:** None (Unauthenticated).\n*   **Preconditions:** The plugin must be active and the `[eeSFL]` shortcode must be placed on a publicly accessible page.\n*   **Payload Type:** Tag-based breakout or JavaScript string breakout.\n\n## 3. Code Flow\n1.  **Entry Point:** An unauthenticated user visits a page containing the `[eeSFL]` shortcode with malicious query parameters (e.g., `?eeSFL_ArchivePath=1&eeSFL_ArchiveListID=1&payload=...`).\n2.","The Simple File List plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the interpolation of user-influenced variables into a script block. Attackers can execute arbitrary JavaScript by crafting URLs with malicious payloads that break out of the JavaScript string context in the front-end file list view.","\u002F\u002F includes\u002Fee-list-display.php line 291\n\u003Cspan class=\"eeHide\" id=\"eeSFL_ID\">' . $eeSFL->eeListID . '\u003C\u002Fspan>\n\n\u003Cscript>\n\tvar eeSFL_ThisURL = \"' . $eeURL . '\";\n\tvar eeSFL_ListID = ' . $eeSFL->eeListID . ';\n\tvar eeSFL_PluginURL = \"' . $eeSFL->eeEnvironment['pluginURL'] . '\";\n\tvar eeSFL_FileListDir = \"' . $eeSFL->eeListSettings['FileListDir'] . '\";\n\tvar eeSFL_SubFolder = \"' . eeSFL_NormalizeSlashes($eeSFL->eeCurrentFolder) . '\";\n\tvar eeSFL_ShortcodeFolder = \"' . eeSFL_NormalizeSlashes($eeSFL->eeShortcodeFolder) . '\";\n\tvar eeSFL_ShowListStyle = \"' . $eeSFL->eeListSettings['ShowListStyle'] . '\";\n\u003C\u002Fscript>","--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsimple-file-list\u002F6.3.8\u002Fincludes\u002Fee-list-display.php\t2026-06-09 18:19:22.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsimple-file-list\u002F6.3.9\u002Fincludes\u002Fee-list-display.php\t2026-06-22 14:41:48.000000000 +0000\n@@ -291,13 +291,13 @@\n \u003Cspan class=\"eeHide\" id=\"eeSFL_ID\">' . $eeSFL->eeListID . '\u003C\u002Fspan>\n \n \u003Cscript>\n-\tvar eeSFL_ThisURL = \"' . $eeURL . '\";\n+\tvar eeSFL_ThisURL = \"' . esc_js($eeURL) . '\";\n \tvar eeSFL_ListID = ' . $eeSFL->eeListID . ';\n-\tvar eeSFL_PluginURL = \"' . $eeSFL->eeEnvironment['pluginURL'] . '\";\n-\tvar eeSFL_FileListDir = \"' . $eeSFL->eeListSettings['FileListDir'] . '\";\n-\tvar eeSFL_SubFolder = \"' . eeSFL_NormalizeSlashes($eeSFL->eeCurrentFolder) . '\";\n-\tvar eeSFL_ShortcodeFolder = \"' . eeSFL_NormalizeSlashes($eeSFL->eeShortcodeFolder) . '\";\n-\tvar eeSFL_ShowListStyle = \"' . $eeSFL->eeListSettings['ShowListStyle'] . '\";\n+\tvar eeSFL_PluginURL = \"' . esc_js($eeSFL->eeEnvironment['pluginURL']) . '\";\n+\tvar eeSFL_FileListDir = \"' . esc_js($eeSFL->eeListSettings['FileListDir']) . '\";\n+\tvar eeSFL_SubFolder = \"' . esc_js(eeSFL_NormalizeSlashes($eeSFL->eeCurrentFolder)) . '\";\n+\tvar eeSFL_ShortcodeFolder = \"' . esc_js(eeSFL_NormalizeSlashes($eeSFL->eeShortcodeFolder)) . '\";\n+\tvar eeSFL_ShowListStyle = \"' . esc_js($eeSFL->eeListSettings['ShowListStyle']) . '\";\n \u003C\u002Fscript>","1. Identify a WordPress page or post containing the `[eeSFL]` shortcode.\n2. Construct a malicious URL targeting this page. The payload should target query parameters that are included in the `$eeURL` variable, which is derived from the current request URL.\n3. Use a breakout payload such as `\";alert(1);\u002F\u002F` to terminate the intended JavaScript string and execute arbitrary code.\n4. Entice a site visitor or administrator to click the malicious link.\n5. When the page loads, the plugin echoes the unescaped URL into an inline `\u003Cscript>` block, triggering the execution of the injected JavaScript in the victim's browser session.","gemini-3-flash-preview","2026-07-25 09:08:58","2026-07-25 09:10:38",{"type":37,"vulnerable_version":38,"fixed_version":11,"vulnerable_browse":39,"vulnerable_zip":40,"fixed_browse":41,"fixed_zip":42,"all_tags":43},"plugin","6.3.8","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fsimple-file-list\u002Ftags\u002F6.3.8","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fsimple-file-list.6.3.8.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fsimple-file-list\u002Ftags\u002F6.3.9","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fsimple-file-list.6.3.9.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fsimple-file-list\u002Ftags"]