CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N
What the vulnerability does
Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6) Vulnerable parameters: &post_title, &downloadable_file_version[0].
Explanation of Vulnerability in Simple Terms
Download Monitor versions up to 4.4.6 contain a stored cross-site scripting (XSS) vulnerability. An authenticated admin can inject malicious scripts into the plugin that execute in other users' browsers when they view affected pages. The vulnerability requires admin privileges and user interaction to exploit, and the impact is limited to modifying page content rather than stealing data or disrupting availability.
What an attacker can do
Inject malicious scripts that run in other users' browsers when they view the site.
Potential impact on your site
A compromised admin account can deface pages or redirect visitors, but cannot steal data or take the site offline.
Conditions required to exploit
Admin-level access to the site and the victim must view a page containing the injected script.
Key dates
External resources
Related vulnerabilities
