CVE-2026-16617 is a stored cross-site scripting (CWE-79) vulnerability in the Simple File List WordPress plugin through version 6.3.11. The flaw arises from improper sanitization and escaping of file descriptions before output on the public file list. This allows unauthenticated attackers to inject malicious scripts that execute in the context of any visitor's browser who views the affected file list, potentially leading to session hijacking, defacement, or other script-based attacks.

An attacker can perform stored XSS attacks by injecting malicious scripts into file descriptions, which then execute in the browsers of any users viewing the public file list. This can lead to theft of user credentials, session tokens, or other malicious actions executed in the victim's browser context. The vulnerability is exploitable by unauthenticated users if front-end file management is enabled.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling front-end file management to prevent unauthenticated users from adding malicious file descriptions. Monitor official vendor channels for updates and apply patches promptly once released.