Critical severity · published Nov 8, 2021
CVE-2021-24693
Simple Download Monitor < 3.9.5 - Contributor+ Stored Cross-Site Scripting via File Thumbnail
9.0
CVSS
1.3%
EPSS
No
On KEV
Description
The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the "File Thumbnail" post meta before outputting it in some pages, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks. Given the that XSS is triggered even when the Download is in a review state, contributor could make JavaScript code execute in a context of a reviewer such as admin and make them create a rogue admin account, or install a malicious plugin
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SD
Simple Download Monitor ·
3.9.5 before 3.9.5 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-24693
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-24693
Exploit
https://wpscan.com/vulnerability/4bb559b7-8dde-4c90-a9a6-d8dcfbea53a7
More from Simple Download Monitor
8.8
CVE-2021-24696
Simple Download Monitor < 3.9.9 - Multiple CSRF
7.5
CVE-2021-24695
Simple Download Monitor < 3.9.6 - Unauthenticated Log Access
6.5
CVE-2021-24692
Simple Download Monitor < 3.9.5 - Contributor+ Arbitrary File Download via Path Traversal
6.1
CVE-2021-24697
Simple Download Monitor < 3.9.5 - Reflected Cross-Site Scripting
5.4
CVE-2021-24694
Simple Download Monitor < 3.9.11 - Contributor+ Stored Cross-Site Scripting via Shortcodes