by Kastro
Paper/Archive/CVE-2021-24693

CVE-2021-24693

Unknown Simple Download Monitor — Simple Download Monitor < 3.9.5 - Contributor+ Stored Cross-Site Scripting via File Thumbnail

EPSS 1%CVSS 9.0
critical.is priorityof 100
41
CVSS 9.0 (NVD)9.0 / 10 × 3027.0Not in CISA KEV+300.0EPSS percentile 70.1.701 × 2014.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the "File Thumbnail" post meta before outputting it in some pages, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks. Given the that XSS is triggered even when the Download is in a review state, contributor could make JavaScript code execute in a context of a reviewer such as admin and make them create a rogue admin account, or install a malicious plugin

Affected

ProductAffectedFixed inSource
Simple Download Monitor3.9.5 – < 3.9.53.9.5CNA

Scores by source

NVD9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

References

refwpscan.com/vulnerability/4bb559b7-8dde-4c90-a9a6-d8dcfbea53a7