To plugin page

Fixed

WordPress WP-DownloadManager plugin <= 1.68.5 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities

4.8

CVSS 3.1 score Medium severity

Monitoring Coming soon

Find out about vulnerable plugins in your websites for free.

Scan your website

Software

WP-DownloadManager

Type

Plugin

Vulnerable versions

<= 1.68.5

Fixed in

1.68.6

PSID

fc55ba6f3f51

CVE ID

CVE-2022-25606

Classification

Cross Site Scripting (XSS)

OWASP Top 10

A7: Cross-Site Scripting (XSS)

Required privilege

Requires high role user authentication like admin.

Credits

Ex.Mi (Patchstack)

Publicly disclosed

2022-01-10

Details

Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered by Ex.Mi (Patchstack) in WordPress WP-DownloadManager plugin (versions <= 1.68.5).

Solution

Update the WordPress WP-DownloadManager plugin to the latest available version (at least 1.68.6)

References

CVE-2022-25606 Plugin changelog

WordPress WP-DownloadManager plugin <= 1.68.5 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities

Details

Solution

References

Other known vulnerabilities for WP-DownloadManager

Submit vulnerabilities and become a verified Alliance member

All solutions

WordPress security

Patchstack

Social

All solutions

WordPress Security

Patchstack

Social

© 2022 Patchstack

WordPress WP-DownloadManager plugin <= 1.68.5 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities

Details

Solution

References

Other known vulnerabilities for WP-DownloadManager

Submit vulnerabilities and become a verified Alliance member

All solutions

WordPress security

Patchstack

Social

All solutions

WordPress Security

Patchstack

Social

© 2022 Patchstack

Let us know if we have missed a vulnerability reported elsewhere

Thank you for contributing!