CVE-2023-2305

CVE-2023-2305 affects the WordPress Download Manager plugin up to version 3.2.70, where stored XSS is possible via the wpdm_members, wpdm_login_form, and wpdm_reg_form shortcodes due to insufficient input sanitization and output escaping. Privileged attackers with contributor-level permissions ca...

CVE-2023-2305 Download Manager <= 3.2.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdmmembers', 'wpdmloginform', 'wpdmregform' shortcodes in versions up to, and including, 3.2.70 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

W3 Eden Addresses Authenticated Stored XSS Vulnerability in Download Manager WordPress Plugin

On April 25, 2023, our Wordfence Threat Intelligence team identified and began the responsible disclosure process for a stored Cross-Site Scripting XSS vulnerability in W3 Eden’s Download Manager plugin, which is actively installed on more than 100,000 WordPress websites, making it one of the mos...

WordPress Download Manager Plugin <= 3.2.70 is vulnerable to Cross Site Scripting (XSS)

Software Download Manager Type Plugin Vulnerable versions = 3.2.70 Fixed in 3.2.71 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2305 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 119cb19208aa Credits Lana Codes...