Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Simple Download Monitor 3.9.5 Clear all filters
TI-2021-06979 CVE-2021-24697 · GHSA-2pc3-m7w9-6vv5

Simple Download Monitor < 3.9.5 - Reflected Cross-Site Scripting

Priority LOW 29

The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the 1) sdm_active_tab GET parameter and 2) sdm_stats_start_date/sdm_stats_end_date POST parameters before outputting them back in attributes, lead…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00827 Published 2021-11-08 Fixed in 3.9.5 CWE-79
TI-2021-06975 CVE-2021-24693 · GHSA-7pfq-9m7r-jmg6

Simple Download Monitor < 3.9.5 - Contributor+ Stored Cross-Site Scripting via File Thumbnail

Priority MEDIUM 41

The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the "File Thumbnail" post meta before outputting it in some pages, which could allow users with a role as low as Contributor to perform Stored Cro…

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.01282 Published 2021-11-08 Fixed in 3.9.5 CWE-79