WordPress CVEs

Description

Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the p parameter.

Affected WordPress components

• Download Monitor Plugin · download-monitor
  Confirmed match Active
  Versions not specified
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• n/a n/a — Versions not specified
• mikejolley download_monitor — Up to and including 1.0.6
• mikejolley download_monitor — Version 1.0.0
• mikejolley download_monitor — Version 1.0.1
• mikejolley download_monitor — Version 1.0.2
• mikejolley download_monitor — Version 1.0.3
• mikejolley download_monitor — Version 1.0.4
• mikejolley download_monitor — Version 1.0.5

References

• plugins.trac.wordpress.org http://plugins.trac.wordpress.org/changeset/723187/download-monitor Exploit, Patch
• secunia.com http://secunia.com/advisories/53116 Vendor Advisory
• www.securityfocus.com http://www.securityfocus.com/bid/61407
• exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/85921
• nvd.nist.gov Official NVD record