The Download Manager Plugin for WordPress is vulnerable to reflected Cross-Site Scripting in versions up to, and including 3.2.42. This is due to insufficient input sanitization and output escaping on the 'frameid' parameter found in the ~/src/Package/views/shortcode-iframe.php file.
References
Configurations
Configuration 1 (hide)
|
History
22 Jun 2022, 13:13
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:wpdownloadmanager:wordpress_download_manager:*:*:*:*:*:wordpress:*:* | |
CVSS |
v2 : v3 : |
v2 : 4.3
v3 : 6.1 |
References | (MISC) https://www.wordfence.com/blog/2022/06/security-vulnerability-download-manager-plugin/ - Exploit, Third Party Advisory | |
References | (MISC) https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2736071%40download-manager&new=2736071%40download-manager&sfp_email=&sfph_mail= - Patch, Third Party Advisory | |
References | (MISC) https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1985 - Third Party Advisory |
13 Jun 2022, 13:26
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-06-13 13:15
Updated : 2024-02-04 22:29
NVD link : CVE-2022-1985
Mitre link : CVE-2022-1985
CVE.ORG link : CVE-2022-1985
JSON object : View
Products Affected
wpdownloadmanager
- wordpress_download_manager
CWE
No CWE.