Download Monitor <= 1.9.6 - Unauthenticated Downloading of Logs

An Unauthenticated attacker can export download logs from the Plugin. Which includes: Download ID, Version ID, Filename, User ID, User Login, User Email, User IP, User Agent, Date, Status. The information could potentially be used to mount further attacks or just collect contact information...

WordPress Download Monitor Plugin <= 1.6.3 - Authenticated Directory Listing

This plugin is prone to an authenticated directory listing vulnerability. It allows attackers list sever side files and directories. Solution Update the plugin...

WordPress Simple Download Monitor Plugin <= 3.2.8 - Insufficient Authorisation

Because of this vulnerability, any user can access the "sdmtinygetpostids" action which will return a JSON encoded list of all "postid"and "posttitle" that were uploaded with this plugin. Solution Upgrade the plugin...

WordPress Simple Download Monitor Plugin <= 3.2.8 - Insufficient Authorisation

Because of this vulnerability, any user can access the "sdmtinygetpostids" action which will return a JSON encoded list of all "postid"and "posttitle" that were uploaded with this plugin. Solution Upgrade the plugin...

WordPress Download Monitor Plugin <= 1.7.0 - Cross Site Scripting

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update the plugin...

Download Monitor <= 1.7.0 - Cross-Site Scripting (XSS)

The Download Monitor WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

Download Monitor <= 1.6.3 - Authenticated Directory Listing

Directory listing vulnerability that can lead to information disclosure. Authenticated users can list sever side files and directories...

CVE-2012-4768

Cross-site scripting XSS vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the dlsearch parameter to the default URI...

Cross site scripting

Cross-site scripting XSS vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the dlsearch parameter to the default URI...

CVE-2012-4768

Cross-site scripting XSS vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the dlsearch parameter to the default URI...

CVE-2012-4768

CVE-2012-4768 is a Cross-Site Scripting vulnerability in the WordPress plugin Download Monitor prior to 3.3.5.9. The dlsearch parameter written to download pages can inject arbitrary JavaScript, potentially leading to session cookie theft, redirects, or malware delivery. Exploitation affects Word...

CVE-2013-5098

Cross-site scripting XSS vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the sort parameter, a different vulnerability than CVE-2013-3262...

CVE-2013-3262

Cross-site scripting XSS vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the p parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the sort parameter, a different vulnerability than CVE-2013-3262...

Cross site scripting

Cross-site scripting XSS vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the p parameter...

CVE-2013-5098

Cross-site scripting XSS vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the sort parameter, a different vulnerability than CVE-2013-3262...

CVE-2013-3262

The CVE-2013-3262 entry concerns an XSS vulnerability in the WordPress Download Monitor plugin for admin/admin.php, exploitable via the p parameter. Affected version: Download Monitor before 3.3.6.2. Root cause: improper handling/sanitization of user-supplied input in the p parameter allows remot...

CVE-2013-3262

Cross-site scripting XSS vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the p parameter...

CVE-2013-5098

CVE-2013-5098 is an XSS vulnerability in the Download Monitor WordPress plugin, reported for admin/admin.php. The issue allows remote attackers to inject arbitrary script/HTML via the sort parameter in versions before 3.3.6.2. Public references indicate an XSS flaw distinct from CVE-2013-3262, wi...

WordPress Download Monitor Plugin <= 3.3.6.1 - XSS #1

Because of this vulnerability in admin/admin.php, the attackers can inject arbitrary web script or HTML via the "sort" parameter. Solution Update the plugin...