CVE-2023-39924

The Simple File List plugin through version 6.1.9 contains a stored cross-site scripting vulnerability in its settings that stems from inadequate sanitization of inputs and escaping of outputs. Attackers with administrator privileges or higher can inject malicious scripts that execute when other users view affected pages, though this vulnerability only affects multisite WordPress installations or those where the unfiltered_html capability has been restricted.

Based on public CVE data (MITRE/NVD).