CVE-2026-16617 is a Stored Cross-Site Scripting vulnerability in the Simple File List WordPress plugin through version 6.3.11. The flaw arises because the plugin fails to properly sanitize and escape the description field of files before outputting it on the public-facing file list. When front-end file management is enabled, unauthenticated users can inject malicious scripts that execute in the browsers of any visitors viewing the list, potentially leading to compromise of confidentiality, integrity, and availability of user sessions and data.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the browsers of visitors to the public file list. This can result in theft of sensitive information, session hijacking, defacement, or other malicious actions impacting confidentiality, integrity, and availability of affected users.

No explicit patch or fix is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling front-end file management or restricting access to the file list to trusted users only to mitigate risk.