WordPress File List Plugin Stored XSS via Unsanitized Descriptions

The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users (when front-end file management is enabled) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the list.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Simple File List WordPress plugin through version 6.3.11 contains a Stored Cross-Site Scripting (XSS) vulnerability in how it handles file descriptions. When front-end file management is enabled, unauthenticated attackers can inject malicious JavaScript into file description fields. Unlike reflected XSS attacks that require victim interaction with a crafted link, this stored variant persists in the database and executes automatically whenever any visitor views the public file list. This affects thousands of WordPress sites using this plugin, particularly those with user-facing file management features enabled. The CVSS 8.8 rating reflects the high risk: attackers can steal session cookies, capture credentials, redirect users to malicious sites, or perform actions on behalf of legitimate visitors without authentication.

Casky's skill library—leveraging Claude AI's reasoning capabilities—identifies this vulnerability through detection patterns aligned with MITRE ATT&CK techniques TA0001 (Initial Access) and TA0043 (Reconnaissance). Practitioners using Casky would observe findings highlighting improper input sanitization and output encoding gaps, specifically detecting when user-supplied data flows into HTML context without escaping dangerous characters like angle brackets and quotes. The platform's 322 matching skills would flag the absence of Content Security Policy headers, missing escaping functions (like wp_kses_post or esc_html), and lack of nonce validation on file upload endpoints. Security teams would see attack chains showing how reconnaissance activities (scanning for the vulnerable plugin version) precede exploitation attempts, with behavioral indicators revealing when attackers enumerate public file lists to identify injection points in description fields.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-16617.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-16617

Casky has 322 skills that investigate the attack patterns behind CVE-2026-16617. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn