CVE-2021-24692

The CVE concerns the WordPress plugin Simple Download Monitor (before 3.9.5). Affected component: the plugin’s access control/file serving logic allows users with roles as low as Contributor to download arbitrary files from the web server (e.g., wp-config.php) via a path traversal vector. Root ca...

CVE-2021-24697

The CVE-2021-24697 entry concerns the WordPress Simple Download Monitor plugin prior to 3.9.5. The vulnerability is a reflected XSS caused by insufficient escaping of the sdm_active_tab (GET) and sdm_stats_start_date/sdm_stats_end_date (POST) parameters when echoed back in HTML attributes. Affect...

CVE-2021-24696

CVE-2021-24696 affects the WordPress plugin Simple Download Monitor prior to version 3.9.9. The root cause is missing nonce checks, enabling cross-site request forgery (CSRF) attacks. Reported impacts include admins exporting logs (potential log disclosure), deleting logs, and removing thumbnail ...

CVE-2021-24693

The CVE pertains to WordPress Simple Download Monitor plugin versions before 3.9.5. The vulnerability is a Stored Cross-Site Scripting (XSS) in the File Thumbnail post meta output, exploitable by users with as little as Contributor role. The underlying issue is lack of escaping the File Thumbnail...

CVE-2020-5651

CVE-2020-5651 affects the WordPress plugin Simple Download Monitor (versions 3.8.8 and earlier). The root cause is SQL injection via a specially crafted URL that bypasses input validation, allowing remote attackers to execute arbitrary SQL commands. Documented impact includes the ability to run a...

CVE-2021-24694

CVE-2021-24694 affects the WordPress plugin Simple Download Monitor up to version 3.9.10. The vulnerability allows attackers with a role as low as Contributor to perform a Stored Cross-Site Scripting (XSS) via shortcodes: either the color/css_class parameters in sdm_download or the class/placehol...

CVE-2020-5650

CVE-2020-5650 is a cross-site scripting (XSS) vulnerability in the WordPress plugin Simple Download Monitor (versions ≤ 3.8.8). The issue allows remote attackers to inject arbitrary scripts via unspecified vectors, potentially affecting the logged-in user’s browser. Multiple connected sources con...

CVE-2021-24695

Summary: The Simple Download Monitor WordPress plugin (before 3.9.6) stores logs in a predictable location and lacks authentication/authorization, allowing unauthenticated users to download and read logs that contain sensitive information (IP addresses, usernames). What’s affected: WordPress plug...

CVE-2021-24698

CVE-2021-24698 affects the WordPress plugin Simple Download Monitor prior to version 3.9.6. The issue is an access-control weakness that lets users with a low role (as low as Contributor) remove thumbnails from downloads they do not own, without being able to edit those downloads. Affected compon...