Unauthenticated Stored XSS in Download Plugins Dashboard for WordPress
CVE-2019-17239

6.1MEDIUM

Key Information:

Vendor
Wordpress
Status
Download Plugins And Themes From Dashboard
Vendor
CVE Published:
7 October 2019

Summary

The Download Plugins Dashboard plugin for WordPress versions up to 1.5.0 exhibits multiple unauthenticated stored cross-site scripting (XSS) vulnerabilities. These flaws allow attackers to inject malicious scripts into the application, which can be executed in the context of other users, potentially leading to unauthorized actions and data theft. Proper sanitization and validation are recommended to mitigate these risks.

References

https://wpvulndb.com/vulnerabilities/9896
x_refsource_MISC
https://wordpress.org/plugins/download-plugins-dashboard/...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.