CVE-2022-3062

Deeper analysis

The Simple File List WordPress plugin before version 4.4.12 is affected by a reflected cross-site scripting vulnerability (CWE-79). The root cause is insufficient escaping of user-supplied parameters before they are written back into HTML attributes, allowing script injection. The issue carries a CVSS 3.1 score of 6.1 with network attack vector, no authentication required, and user-interaction dependency.

An unauthenticated attacker can craft a malicious link or request that, when visited by a victim, causes the plugin to reflect attacker-controlled content into the page. Successful exploitation enables theft of session tokens, redirection, or limited page manipulation within the context of the vulnerable site.

The referenced WPScan advisory identifies the flaw in versions prior to 4.4.12 and indicates that updating the Simple File List plugin to 4.4.12 or later removes the reflected XSS vectors.

EPSS for the CVE reached a peak of 0.4866 before settling at the current value of 0.3702, indicating measurable post-disclosure exploitation interest.