CVE Database /
CVE-2024-8444
CVE · Medium
CVE-2024-8444 — Download Manager [download-manager] < 3.3.00
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2024-8444
|
Download Manager [download-manager] < 3.3.00 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
5.4
|
< 3.3.00
|
3.3.00 |
2024-10-09 |
—
|
CVE-2024-8444
The Download Manager plugin for WordPress contains a security flaw in its 'wpdm_login_form' shortcode, which allows malicious users with elevated privileges to introduce unauthorized code into the website's content through unfiltered input attributes. This vulnerability affects all versions of the plugin up to and including 3.2.99, enabling attackers to inject scripts that will execute when accessed by other users.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings