Cross-Site Scripting Vulnerability in Simple Download Monitor Plugin for WordPress
CVE-2018-5212

5.4MEDIUM

Key Information:

Vendor
Wordpress
Status
Simple Download Monitor
Vendor
CVE Published:
4 January 2018

Summary

The Simple Download Monitor plugin for WordPress prior to version 3.5.4 is susceptible to a Cross-Site Scripting (XSS) vulnerability. This flaw enables attackers to inject malicious scripts through the 'sdm_upload_thumbnail' parameter during the edit action in 'wp-admin/post.php'. Once successfully exploited, unauthorized users may execute arbitrary JavaScript code, potentially compromising the security of the website and its users. Website owners are strongly advised to update to the latest version to mitigate this risk effectively.

References

https://github.com/d4wner/Vulnerabilities-Report/blob/mas...
x_refsource_MISC
https://github.com/Arsenal21/simple-download-monitor/issu...
x_refsource_MISC
https://wordpress.org/support/topic/stored-xss-bug-at-the...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.