CVE-2021-24695

The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not have any authentication or authorisation in place to prevent unauthenticated users to download and read the logs containing Sensitive Information such as IP Addresses and Usernames...

CVE-2021-24697

The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the 1 sdmactivetab GET parameter and 2 sdmstatsstartdate/sdmstatsenddate POST parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues...

Authentication flaw

The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not have any authentication or authorisation in place to prevent unauthenticated users to download and read the logs containing Sensitive Information such as IP Addresses and Usernames...

CVE-2021-24698

The Simple Download Monitor WordPress plugin before 3.9.6 allows users with a role as low as Contributor to remove thumbnails from downloads they do not own, even if they cannot normally edit the download...

CVE-2021-24698

CVE-2021-24698 affects the WordPress plugin Simple Download Monitor prior to version 3.9.6. The issue is an access-control weakness that lets users with a low role (as low as Contributor) remove thumbnails from downloads they do not own, without being able to edit those downloads. Affected compon...

CVE-2021-24697

The CVE-2021-24697 entry concerns the WordPress Simple Download Monitor plugin prior to 3.9.5. The vulnerability is a reflected XSS caused by insufficient escaping of the sdm_active_tab (GET) and sdm_stats_start_date/sdm_stats_end_date (POST) parameters when echoed back in HTML attributes. Affect...

CVE-2021-24695 Simple Download Monitor < 3.9.6 - Unauthenticated Log Access

The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not have any authentication or authorisation in place to prevent unauthenticated users to download and read the logs containing Sensitive Information such as IP Addresses and Usernames...

CVE-2021-24695

Summary: The Simple Download Monitor WordPress plugin (before 3.9.6) stores logs in a predictable location and lacks authentication/authorization, allowing unauthenticated users to download and read logs that contain sensitive information (IP addresses, usernames). What’s affected: WordPress plug...

CVE-2021-24693 Simple Download Monitor < 3.9.5 - Contributor+ Stored Cross-Site Scripting via File Thumbnail

The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the "File Thumbnail" post meta before outputting it in some pages, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks. Given the that XSS is triggered even when the...

CVE-2021-24693

The CVE pertains to WordPress Simple Download Monitor plugin versions before 3.9.5. The vulnerability is a Stored Cross-Site Scripting (XSS) in the File Thumbnail post meta output, exploitable by users with as little as Contributor role. The underlying issue is lack of escaping the File Thumbnail...

PT-2021-16200 · WordPress · Simple Download Monitor

Name of the Vulnerable Software and Affected Versions: Simple Download Monitor WordPress plugin versions prior to 3.9.6 Description: The issue allows unauthenticated users to download and read logs containing sensitive information, such as IP addresses and usernames, due to the logs being saved i...

WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. The WordPress plugin suffers from a cross-site scripting...

WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The WordPress plugin is a WordPress open source application plugin. WordPress plugin Simple Download Monitor version 3.9.5 before the cross-site scripting vulnerability, the vulnerability stems from...

WordPress 插件访问控制错误漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. WordPress plugin is a WordPress open source application plugin. WordPress plugin Simple Download Monitor...

WordPress plugin Simple Download Monitor 信息泄露漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. WordPress plugin Simple Download Monitor version...

WordPress Download Monitor plugin <= 4.4.6 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

Authenticated Reflected Cross-Site Scripting XSS vulnerability discovered by Nguy Minh Tuan in WordPress Download Monitor plugin versions = 4.4.6. Solution Update the WordPress Download Monitor plugin to the latest available version at least 4.4.7...

Download Monitor < 4.4.7 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape the postid and downloadablefileversion parameters, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks...

WordPress Download Monitor plugin <= 4.4.6 - Authenticated Arbitrary File Download vulnerability

Authenticated Arbitrary File Download vulnerability discovered by Ex.Mi Patchstack in WordPress Download Monitor plugin versions = 4.4.6. Solution Update the WordPress Download Monitor plugin to the latest available version at least 4.4.7...

Download Monitor < 4.4.7 - Admin+ Arbitrary File Download

The plugin does not validate files to be downloaded, which could allow high privilege users such as admin to access arbitrary files from the server...

WordPress Download Monitor plugin <= 4.4.6 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability

Authenticated Persistent Cross-Site Scripting XSS vulnerability discovered by Ex.Mi Patchstack WordPress Download Monitor plugin versions = 4.4.6. Solution Update the WordPress Download Monitor plugin to the latest available version at least 4.4.7...