CVE-2023-2305 Download Manager <= 3.2.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdmmembers', 'wpdmloginform', 'wpdmregform' shortcodes in versions up to, and including, 3.2.70 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

WordPress Plugin Download Manager 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress Download Manager Plugin < 3.2.71 Improper Access Control Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wpdownloadmanager:wordpressdownloadmanager"; ifdescription...

CVE-2023-1524

The Download Manager WordPress plugin before 3.2.71 does not adequately validate passwords for password-protected files. Upon validation, a master key is generated and exposed to the user, which may be used to download any password-protected file on the server, allowing a user to download any fil...

Default credentials

The Download Manager WordPress plugin before 3.2.71 does not adequately validate passwords for password-protected files. Upon validation, a master key is generated and exposed to the user, which may be used to download any password-protected file on the server, allowing a user to download any fil...

CVE-2023-1524 Download Manager < 3.2.71 - Broken Access Controls

The Download Manager WordPress plugin before 3.2.71 does not adequately validate passwords for password-protected files. Upon validation, a master key is generated and exposed to the user, which may be used to download any password-protected file on the server, allowing a user to download any fil...

CVE-2023-1524

The CVE-2023-1524 issue affects the WordPress Download Manager plugin prior to version 3.2.71. According to multiple sources, the vulnerability is an improper access control: during password validation a master key is generated and exposed to the user, which can be used to download any password‑p...

WordPress plugin Download Manager 访问控制错误漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

PT-2023-17052 · WordPress · Download Manager

Name of the Vulnerable Software and Affected Versions: Download Manager WordPress plugin versions prior to 3.2.71 Description: The issue concerns inadequate password validation for password-protected files. When a password is validated, a master key is generated and exposed to the user. This mast...

WordPress Download Manager Plugin < 3.2.71 is vulnerable to Broken Access Control

Software Download Manager Type Plugin Vulnerable versions 3.2.71 Fixed in 3.2.71 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-1524 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 4024de402784 Credits Johan Kragt Required privileg...

W3 Eden Addresses Authenticated Stored XSS Vulnerability in Download Manager WordPress Plugin

On April 25, 2023, our Wordfence Threat Intelligence team identified and began the responsible disclosure process for a stored Cross-Site Scripting XSS vulnerability in W3 Eden’s Download Manager plugin, which is actively installed on more than 100,000 WordPress websites, making it one of the mos...

W3 Eden Download Manager 3.2.70 Cross Site Scripting

W3 Eden recently patched an Authenticated Stored Cross-Site Scripting vulnerability in Download Manager. On April 25, 2023, our Wordfence Threat Intelligence team identified and began the responsible disclosure process for a stored Cross-Site Scripting XSS vulnerability in W3 Eden’s Download...

WordPress Download Manager Plugin <= 3.2.70 is vulnerable to Cross Site Scripting (XSS)

Software Download Manager Type Plugin Vulnerable versions = 3.2.70 Fixed in 3.2.71 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2305 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 119cb19208aa Credits Lana Codes...

Download Manager < 3.2.71 - Contributor+ Stored Cross-Site Scripting

The plugin does not properly sanitize and escape user-supplied attributes in 'wpdmmembers', 'wpdmloginform', and 'wpdmregform' shortcodes, leading to Stored Cross-Site Scripting vulnerabilities...

Download Manager < 3.2.71 - Broken Access Controls

The plugin does not adequately validate passwords for password-protected files. Upon validation, a master key is generated and exposed to the user, which may be used to download any password-protected file on the server, allowing a user to download any file with the knowledge of any one file's...

Download Manager < 3.2.71 - Broken Access Controls

The plugin does not adequately validate passwords for password-protected files. Upon validation, a master key is generated and exposed to the user, which may be used to download any password-protected file on the server, allowing a user to download any file with the knowledge of any one file's...

CVE-2023-22713

Auth. contributor+ Cross-Site Scripting XSS vulnerability in WordPress Download Manager Gutenberg Blocks by WordPress Download Manager plugin = 2.1.8 versions...

CVE-2023-22713

Auth. contributor+ Cross-Site Scripting XSS vulnerability in WordPress Download Manager Gutenberg Blocks by WordPress Download Manager plugin = 2.1.8 versions...

Cross site scripting

Auth. contributor+ Cross-Site Scripting XSS vulnerability in WordPress Download Manager Gutenberg Blocks by WordPress Download Manager plugin = 2.1.8 versions...

CVE-2023-22713 WordPress Gutenberg Blocks by WordPress Download Manager Plugin <= 2.1.8 is vulnerable to Cross Site Scripting (XSS)

Auth. contributor+ Cross-Site Scripting XSS vulnerability in WordPress Download Manager Gutenberg Blocks by WordPress Download Manager plugin = 2.1.8 versions...