What the vulnerability does
01Description
A vulnerability was found in Media Downloader Plugin 0.1.992 on WordPress. It has been declared as problematic. This vulnerability affects the function dl_file_resumable of the file getfile.php. The manipulation of the argument file leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 0.1.993 is able to address this issue. The patch is identified as 77beb720c682b9300035ab5f96eee225181d8a92. It is recommended to upgrade the affected component. VDB-222262 is the identifier assigned to this vulnerability.
Explanation of Vulnerability in Simple Terms
02Summary
The Media Downloader Plugin contains a stored cross-site scripting (XSS) vulnerability in version 0.1.992. An authenticated user with low privileges can inject malicious scripts that execute in the browsers of other users viewing affected content. The vulnerability requires user interaction to trigger. This allows attackers to steal session tokens, redirect users, or deface content.
What an attacker can do
03Attacker Capabilities
Inject malicious scripts that run in other users' browsers when they view the plugin's content.
Potential impact on your site
04Site Impact
Authenticated users can inject scripts affecting other site visitors, risking credential theft and malware distribution.
Conditions required to exploit
05Prerequisites
Attacker must be logged in with low-level user privileges. Victim must visit a page containing the injected script.
Key dates
06Disclosure timeline
March 4, 2023
CVE published
March 5, 2025
Record updated
