CVE-2014-9129

Cross-site request forgery CSRF vulnerability in the CreativeMinds CM Downloads Manager plugin before 2.0.7 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the addonstitle parameter in the...

CVE-2014-9129

Cross-site request forgery CSRF vulnerability in the CreativeMinds CM Downloads Manager plugin before 2.0.7 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the addonstitle parameter in the...

CVE-2014-9129

CM Download Manager (WordPress) before version 2.0.7 is affected by CVE-2014-9129: a CSRF vulnerability allows authenticated admins to be hijacked and stored XSS via the addons_title field on the CMDM_admin_settings page (POST to wp-admin/admin.php). Root cause: insufficient validation/CSRF prote...