Input validation vulnerability in Simple File List 6.1.9

The Simple File List plugin for WordPress is vulnerable to a type of cyber attack called Stored Cross-Site Scripting. This attack can be performed on versions up to, and including, 6.1.9. This type of attack is possible because the plugin does not properly filter and protect the data that is inputted into it. An attacker with administrator-level access would be able to insert malicious web scripts into pages, which would then execute automatically when a user visits that page. This vulnerability is only present on multi-site installations and installations where an additional security feature called unfiltered_html has been disabled.