PT-2021-16270
CVE-2021-24773
·
Published
2021-11-01
·
Updated
2021-11-02
Description by
CVSS 3.1
4.8
MediumMetricsAV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions:
WordPress Download Manager versions prior to 3.2.16
Description:
The issue allows high privilege users to perform XSS attacks even when the unfiltered html capability is disallowed, due to the plugin not escaping some of the Download settings when outputting them.
Recommendations:
For versions prior to 3.2.16, update to version 3.2.16 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Download settings feature to minimize the risk of exploitation.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾