Download Manager < 3.3.00 – Contributor+ Stored XSS | CVE 2024-8444

Description

The plugin doesn't sanitize some of it's shortcode parameters, leading to cross site scripting.

Proof of Concept

As a contributor create a post with the following shortcode:

[wpdm_login_form regurl='" onmouseover="alert(1)"']

When viewing the post as a logged out user hover the mouse over the register now link and verify that the payload activates.

Affects Plugins

download-manager

Fixed in 3.3.00

References

CVE

CVE-2024-8444

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CWE-79

CVSS

3.5 (low)

Miscellaneous

Original Researcher

Miguel Xavier Penha Neto

Submitter

Miguel Xavier Penha Neto

Submitter website

https://miguelxpn.com

Verified

Yes

WPVDB ID

bf2f5aa8-a161-43ff-a6ee-8603aaba8012

Timeline

Publicly Published

2024-10-09 (about 1 year ago)

Added

2024-10-09 (about 1 year ago)

Last Updated

2024-10-09 (about 1 year ago)

Other

Published

Title

Published

2010-12-07

Title

Twitter Feed < 1.0 - XSS

Published

2025-04-14

Title

Course Booking System < 6.1.3 - Reflected Cross-Site Scripting

Published

2023-02-02

Title

Avalex < 3.0.4 - Admin+ Stored XSS

Published

2025-09-22

Title

Upsell Order Bump Offer for WooCommerce < 3.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2025-04-01

Title

Nemesis All-in-One <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting