WordPress Simple Download Monitor plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. cross-site request forgery vulnerability exists in versions prior to Wordpress Plugin Simple Download Monitor 3.9.9, which...

CVE-2021-24694

The Simple Download Monitor WordPress plugin before 3.9.11 could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attack via 1 "color" or "cssclass" argument of sdmdownload shortcode, 2 "class" or "placeholder" argument of sdmsearchform shortcode...

CVE-2021-24696

The Simple Download Monitor WordPress plugin before 3.9.9 does not enforce nonce checks, which could allow attackers to perform CSRF attacks to 1 make admins export logs to exploit a separate log disclosure vulnerability fixed in 3.9.6, 2 delete logs fixed in 3.9.9, 3 remove thumbnail image from...

CVE-2021-24694

The Simple Download Monitor WordPress plugin before 3.9.11 could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attack via 1 "color" or "cssclass" argument of sdmdownload shortcode, 2 "class" or "placeholder" argument of sdmsearchform shortcode...

CVE-2021-24696

The Simple Download Monitor WordPress plugin before 3.9.9 does not enforce nonce checks, which could allow attackers to perform CSRF attacks to 1 make admins export logs to exploit a separate log disclosure vulnerability fixed in 3.9.6, 2 delete logs fixed in 3.9.9, 3 remove thumbnail image from...

CVE-2021-24696

CVE-2021-24696 affects the WordPress plugin Simple Download Monitor prior to version 3.9.9. The root cause is missing nonce checks, enabling cross-site request forgery (CSRF) attacks. Reported impacts include admins exporting logs (potential log disclosure), deleting logs, and removing thumbnail ...

CVE-2021-24694 Simple Download Monitor < 3.9.11 - Contributor+ Stored Cross-Site Scripting via Shortcodes

The Simple Download Monitor WordPress plugin before 3.9.11 could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attack via 1 "color" or "cssclass" argument of sdmdownload shortcode, 2 "class" or "placeholder" argument of sdmsearchform shortcode...

CVE-2021-24694

CVE-2021-24694 affects the WordPress plugin Simple Download Monitor up to version 3.9.10. The vulnerability allows attackers with a role as low as Contributor to perform a Stored Cross-Site Scripting (XSS) via shortcodes: either the color/css_class parameters in sdm_download or the class/placehol...

WordPress plugin 跨站脚本漏洞

WordPress is a set of blogging platforms developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. cross-site scripting vulnerability exists in versions prior to Wordpress Plugin Simple Download Monitor 3.9.11, which stems fr...

WordPress plugin 跨站请求伪造漏洞

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. cross-site request forgery vulnerability exists in versions prior to Wordpress Plugin Simple Download Monitor 3.9.9, which...

WordPress Download Monitor Plugin < 4.4.5 SQLi Vulnerability

The WordPress plugin Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

WordPress Download Monitor Plugin < 4.4.7 XSS Vulnerability

The WordPress plugin Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

CVE-2021-36920

Authenticated Reflected Cross-Site Scripting XSS vulnerability discovered in WordPress plugin Download Monitor versions = 4.4.6...

CVE-2021-36920

Authenticated Reflected Cross-Site Scripting XSS vulnerability discovered in WordPress plugin Download Monitor versions = 4.4.6...

Cross site scripting

Authenticated Reflected Cross-Site Scripting XSS vulnerability discovered in WordPress plugin Download Monitor versions = 4.4.6...

CVE-2021-36920 WordPress plugin Download Monitor <= 4.4.6 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

Authenticated Reflected Cross-Site Scripting XSS vulnerability discovered in WordPress plugin Download Monitor versions = 4.4.6...

CVE-2021-36920

CVE-2021-36920 affects the WordPress plugin Download Monitor (versions

CVE-2021-36920 WordPress plugin Download Monitor <= 4.4.6 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

Authenticated Reflected Cross-Site Scripting XSS vulnerability discovered in WordPress plugin Download Monitor versions = 4.4.6...

WordPress plugin 跨站脚本漏洞

WordPress plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in WordPress plugin, which stems from an authenticated Reflected Cross-Site Scripting XSS vulnerability discovered in the WordPress Plugin Download Monitor version = 4.4.6...

Download Monitor < 4.4.7 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting issues...