CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
What the vulnerability does
Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered in WP-DownloadManager WordPress plugin (versions <= 1.68.6). Vulnerable parameters &download_path, &download_path_url, &download_page_url, &download_categories.
Explanation of Vulnerability in Simple Terms
WP-DownloadManager versions up to 1.68.5 contain a cross-site scripting (XSS) vulnerability that allows authenticated users with high privileges to inject malicious scripts. The vulnerability requires user interaction and affects the site's integrity and confidentiality. Site administrators should update to a version newer than 1.68.5.
What an attacker can do
Inject malicious scripts that execute in other users' browsers when they visit affected pages.
Potential impact on your site
Admins with high privileges could be tricked into executing malicious scripts, potentially compromising site data or user accounts.
Conditions required to exploit
Attacker must have high-level admin privileges and trick a user into visiting a crafted link.
Key dates
External resources
Related vulnerabilities
