CVE-2021-24697

Name of the Vulnerable Software and Affected Versions Simple Download Monitor WordPress plugin versions prior to 3.9.5

Description The issue arises from the failure to escape certain parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues. The parameters in question are the sdm active tab GET parameter and the sdm stats start date and sdm stats end date POST parameters.

Recommendations For versions prior to 3.9.5, update to version 3.9.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the parameters sdm active tab, sdm stats start date, and sdm stats end date to minimize the risk of exploitation.