CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
What the vulnerability does
Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered in WP-DownloadManager WordPress plugin (versions <= 1.68.6). Vvulnerable parameters &download_path, &download_path_url, &download_page_url.
Explanation of Vulnerability in Simple Terms
WP-DownloadManager versions up to 1.68.6 contain a cross-site scripting (XSS) vulnerability that allows authenticated administrators to inject malicious scripts. The vulnerability requires an admin to visit a specially crafted page or link. Successful exploitation can compromise site integrity and expose visitor data.
What an attacker can do
Inject malicious JavaScript that runs in the browsers of site visitors and administrators.
Potential impact on your site
An admin account could be used to inject scripts affecting all site visitors, potentially stealing credentials or modifying site content.
Conditions required to exploit
Attacker must have administrator privileges and the victim admin must click a malicious link or visit a crafted page.
Key dates
External resources
Related vulnerabilities
