CVE-2021-24969CWE-79

Download Manager < 3.2.22 - Subscriber+ Stored Cross-Site Scripting

published December 27, 2021

CVSS
—
EPSS
1%
Percentile
49.0
In the wild
Unconfirmed
What it is

The WordPress Download Manager WordPress plugin before 3.2.22 does not sanitise and escape Template data before outputting it in various pages (such as admin dashboard and frontend). Due to the lack of authorisation and CSRF checks in the wpdm_save_template AJAX action, any authenticated users such as subscriber is able to call it and perform Cross-Site Scripting attacks

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00620 · 49.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-12-27T10:33Z
EPSS history
Timeline
  • 27 DEC 10:33Z
    Download Manager < 3.2.22 - Subscriber+ Stored Cross-Site Scripting
    cvelistv5