What is the CVSS score of CVE-2026-57382?

CVE-2026-57382 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of Simple File List are affected by CVE-2026-57382?

The Simple File List WordPress plugin (versions 6.3.8 and earlier) contains a vulnerability allowing attackers to hijack administrator accounts and take complete control of affected WordPress…

How to fix or mitigate CVE-2026-57382?

Within 24 hours, identify all WordPress installations running Simple File List plugin versions 6.3.8 or earlier and disable the plugin immediately to eliminate the attack vector. Over the next 7 days, implement web application firewall rules to filter malicious requests targeting the plugin's vulnerable endpoints, enable comprehensive logging of WordPress administrator activities, and review recent access logs for signs of exploitation attempts. Within 30 days, continuously monitor the plugin vendor's security advisories; upon patch release, immediately upgrade Simple File List to the corrected version and conduct forensic audits of administrator accounts and session histories on all affected sites.

Simple File List CVE-2026-57382

EUVD-2026-43457 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

WordPress XSS Simple File List Wordpress Plugin

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Reflected XSS is network-reachable with no privileges but needs victim click (UI:R); script escaping plugin context yields S:C with low C/I/A impacts.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:03 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mitchell Bennis Simple File List simple-file-list allows Reflected XSS.This issue affects Simple File List: from n/a through <= 6.3.8.

AnalysisAI

Reflected cross-site scripting in the Simple File List WordPress plugin (versions up to and including 6.3.8) allows remote attackers to inject arbitrary JavaScript that executes in a victim's browser when they click a crafted link. The scope-changed CVSS vector (S:C) reflects that injected script escapes the plugin's context to affect the broader WordPress site, potentially hijacking authenticated admin sessions. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided.

Technical ContextAI

Simple File List (vendor Mitchell Bennis, slug simple-file-list) is a WordPress plugin that lets site owners publish downloadable file lists and manage uploads through the WordPress front end and admin dashboard. The root cause is CWE-79, Improper Neutralization of Input During Web Page Generation: user-controllable input is reflected back into an HTML response without adequate output encoding or context-aware escaping, so a browser interprets attacker-supplied markup as executable script. As a WordPress plugin, it runs inside the site's PHP request lifecycle, meaning reflected script executes with the DOM and cookie context of the WordPress origin. The single affected CPE is cpe:2.3:a:mitchell_bennis:simple_file_list:*:*:*:*:*:*:*:*.

RemediationAI

No vendor-released patch version was identified in the provided data - the advisory states the issue affects the plugin through <= 6.3.8 without naming a fixed release, so administrators should check the WordPress.org plugin page and the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/simple-file-list/vulnerability/wordpress-simple-file-list-plugin-6-3-8-reflected-cross-site-scripting-xss-vulnerability) for an update newer than 6.3.8 and apply it as the primary fix. Until a patched release is confirmed and installed, deploy a Web Application Firewall (such as Patchstack's own virtual patching or a WAF rule) to filter reflected XSS payloads targeting the plugin's parameters, accepting that WAF rules may generate false positives on legitimate file names. As additional compensating controls, restrict or disable the plugin if it is not actively used, and ensure administrators avoid clicking untrusted links to the site; a Content-Security-Policy that disallows inline script execution would blunt payload execution at the cost of breaking themes or plugins that rely on inline scripts.