CVE-2021-24694CWE-79

Simple Download Monitor < 3.9.11 - Contributor+ Stored Cross-Site Scripting via Shortcodes

published January 24, 2022

CVSS
—
EPSS
1%
Percentile
48.6
In the wild
Unconfirmed
What it is

The Simple Download Monitor WordPress plugin before 3.9.11 could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attack via 1) "color" or "css_class" argument of sdm_download shortcode, 2) "class" or "placeholder" argument of sdm_search_form shortcode.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00611 · 48.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-01-24T08:00Z
EPSS history
Timeline
  • 24 JAN 08:00Z
    Simple Download Monitor < 3.9.11 - Contributor+ Stored Cross-Site Scripting via Shortcodes
    cvelistv5