Medium severity · published Oct 10, 2022
CVE-2022-3207
Simple File List < 4.4.12 - Admin+ Stored Cross-Site Scripting
4.8
CVSS
0.6%
EPSS
No
On KEV
Description
The Simple File List WordPress plugin before 4.4.12 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SF
Simple File List ·
4.4.12 before 4.4.12 · source: vendor
SI
Simple-file-list · Simplefilelist
before 4.4.12 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-3207
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-3207
Exploit
https://wpscan.com/vulnerability/b57272ea-9a8a-482a-bbaa-5f202ca5b9aa
More from Simple File List
8.8
CVE-2026-16617
Simple File List <= 6.3.11 - Unauthenticated Stored XSS via File Description
8.6
CVE-2026-16616
Simple File List <= 6.3.11 - Unauthenticated Arbitrary File Read and Move via Path Traversal
6.5
CVE-2022-3208
Simple File List < 4.4.13 - Page Creation via CSRF
5.4
CVE-2024-10146
Simple File List < 6.1.13 - Reflected Cross-Site Scripting