PT-2022-17400 · WordPress · Wp-Downloadmanager

Re-Alter + 1 · Published 2022-03-25 · Updated 2022-03-30 · CVE-2022-25606

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP-DownloadManager WordPress plugin versions <= 1.68.6

Description Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities were discovered in the WP-DownloadManager WordPress plugin. The vulnerable parameters are download path, download path url, download page url, and download categories.

Recommendations For WP-DownloadManager WordPress plugin versions <= 1.68.6, update to a version higher than 1.68.6 to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable parameters download path, download path url, download page url, and download categories to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-25606

Affected Products

Wp-Downloadmanager

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-25606 · Security Note
• https://osv.dev/vulnerability/CVE-2022-25606 · Vendor Advisory
• https://patchstack.com/database/vulnerability/wp-downloadmanager/wordpress-wp-downloadmanager-plugin-1-68-5-multiple-authenticated-stored-cross-site-scripting-xss-vulnerabilities · Note
• https://t.me/cibsecurity/39573 · Telegram Post
• https://wordpress.org/plugins/wp-downloadmanager/#developers · Note