TI-2021-06975 Aliases CVE-2021-24693 GHSA-7pfq-9m7r-jmg6

Simple Download Monitor < 3.9.5 - Contributor+ Stored Cross-Site Scripting via File Thumbnail

MEDIUM 41CWE-79Published 2021-11-08 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the "File Thumbnail" post meta before outputting it in some pages, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks. Given the that XSS is triggered even when the Download is in a review state, contributor could make JavaScript code execute in a context of a reviewer such as admin and make them create a rogue admin account, or install a malicious plugin

Why it matters now

EPSS 0.01282 70th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Simple Download Monitor (Unknown): 3.9.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	Simple Download Monitor	3.9.5 to before 3.9.5	3.9.5	Patch available	CNA

Simple Download Monitor VendorUnknown Affected 3.9.5 to before 3.9.5 Fixed in 3.9.5 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:tipsandtricks-hq:simple_download_monitor::::::wordpress::*	before 3.9.5	Vulnerable	mra13

cpe:2.3:a:tipsandtricks-hq:simple_download_monitor:*:*:*:*:*:wordpress:*:* Versions before 3.9.5 Vulnerable ·mra13

Remediation

Fix · CNA Simple Download Monitor (Unknown) Fixed in 3.9.5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2021-11-08
Simple Download Monitor 3.9.5
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2021-06979 Simple Download Monitor < 3.9.5 - Reflected Cross-Site ScriptingPriority LOW 29
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2021-24693
2026-10-03 Alias added: GHSA-7pfq-9m7r-jmg6

References

Exploit 1

https://wpscan.com/vulnerability/4bb559b7-8dde-4c90-a9a6-d8dcfbea53a7

TI-2020-04618 SQL injection in Tips and Tricks HQ Simple Download Monitor CVSS 3.1HIGH 8.8
TI-2021-06978 Simple Download Monitor < 3.9.9 - Multiple CSRF CVSS 3.1HIGH 8.8
TI-2021-06977 Simple Download Monitor < 3.9.6 - Unauthenticated Log Access CVSS 3.1HIGH 7.5
TI-2021-06974 Simple Download Monitor < 3.9.5 - Contributor+ Arbitrary File Download via Path Traversal CVSS 3.1MEDIUM 6.5
TI-2021-06979 Simple Download Monitor < 3.9.5 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
TI-2020-04617 Cross-site scripting in Tips and Tricks HQ Simple Download Monitor CVSS 3.1MEDIUM 6.1

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences