Vulnerability feed

Executive summary

The Download Monitor WordPress plugin is affected by a cross-site scripting flaw that the advisory says is high severity, with a CVSS score of 7.1 listed. The vendor's recommended action is to update the plugin to version 5.3.4, which the advisory identifies as the fixed version.

Technical summary

The flaw is a cross-site scripting (XSS, CWE-79) issue in which the plugin does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the content. The advisory does not describe the exact attack vector or required user interaction beyond the clicked link, and it does not state the affected version range beyond 'before 5.3.4'. The fixed version is 5.3.4. The advisory does not state any workaround, and it gives no detection guidance or information on whether the flaw is being exploited in the wild. The CVSS score is listed as 7.1 (high), but the vector string is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from wpscan.com/vulnerability/03d5e83b-3119-…62-b1be-8c6fe53f9963

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

Required

Scope

Changed

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Affects

Download MonitorDownload Monitor download-monitor

Executive summary

The Download Monitor WordPress plugin, before version 5.3.5, lets network administrators manage the list of filesystem locations it may serve files from, but it does not restrict that control correctly. The advisory rates the issue medium severity with a CVSS score of 4.9. The fix is to update the plugin to version 5.3.5 or later.

Technical summary

The flaw is classified as incorrect authorisation (CWE-863, OWASP A5 Broken Access Control) in the Download Monitor WordPress plugin before 5.3.5. The advisory states that management of the allowed filesystem locations is not correctly restricted to network administrators. The attack vector, required privileges beyond the network administrator role, and exploitation status are not stated. The fixed version is 5.3.5. No workaround and no detection guidance are stated in the advisory.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from wpscan.com/vulnerability/fa0d1250-6408-…45-9033-b6a9a16d3e67

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

High

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Affects

Download MonitorDownload Monitor download-monitor