CVE-2012-4768 Download Monitor <= 3.3.5.8 - Reflected Cross-Site Scripting
MediumCVSS 4.3
EPSS 10.5%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the dlsearch parameter to the default URI.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mikejolley download monitor | = 3.3.5.7 | No fix listed |
| wordpress download-monitor(WordPress) | < 3.3.5.9 | 3.3.5.9 |
References
- 20120909 Wordpress Download Monitor - Download Page Cross-Site Scripting exploit mailing-list
- 85319 vdb-entry
- packetstormsecurity.org exploit
- 50511 third-party-advisory
- www.reactionpenetrationtesting.co.uk
- downloadmonitor-index-xss(78422) vdb-entry
- Wordfence Intelligence third-party-advisory
- www.cve.org