Cross-Site Scripting Vulnerability in Download Manager Plugin for WordPress
CVE-2024-8284
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 15 May 2025
Badges
What is CVE-2024-8284?
The Download Manager plugin for WordPress, prior to version 3.2.99, contains a vulnerability where insufficient sanitization and escaping of settings can be exploited. This flaw allows users with high privileges, such as editors, to execute Cross-Site Scripting (XSS) attacks, even if the unfiltered_html capability is disabled. Attackers could exploit this issue to inject malicious scripts into the site, posing significant risks to site security and user data.
Affected Version(s)
Download Manager 0 < 3.2.99
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V3.1
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved