CVE Database /
CVE-2023-2305
CVE · Medium
CVE-2023-2305 — Download Manager [download-manager] < 3.2.71
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2023-2305
|
Download Manager [download-manager] < 3.2.71 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
5.4
|
< 3.2.71
|
3.2.71 |
2023-05-12 |
—
|
CVE-2023-2305
The Download Manager plugin for WordPress contains a stored cross-site scripting flaw affecting versions 3.2.70 and earlier in the 'wpdm_members', 'wpdm_login_form', and 'wpdm_reg_form' shortcodes. The vulnerability stems from inadequate sanitization and escaping of user-supplied shortcode attributes, allowing authenticated users with contributor privileges or higher to embed malicious scripts into pages. These injected scripts execute in the browsers of anyone viewing the affected pages.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings