Cross-Site Scripting Vulnerability in File Download Plugin for WordPress
CVE-2015-1000004

6.1MEDIUM

Key Information:

Vendor
Wordpress
Status
Filedownload
Vendor
CVE Published:
6 October 2016

Summary

A Cross-Site Scripting (XSS) vulnerability has been identified in the File Download plugin version 1.4 for WordPress, allowing attackers to inject malicious scripts into web pages viewed by users. This can potentially lead to data theft, session hijacking, and other malicious activities. Users of the affected plugin are advised to take immediate action to mitigate these risks by updating to the latest version or applying necessary patches.

References

http://www.vapidlabs.com/advisory.php?v=140
x_refsource_MISC
http://www.securityfocus.com/bid/97107
vdb-entryx_refsource_BID

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.