CVE-2019-15889

MEDIUMNuclei

WordPress Plugin Download Manager 2.9.93 - Cross-Site Scripting

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2019-15889 has a selected CVSS score of 6.1 (medium); EIP currently links 1 catalogued exploit and 1 Nuclei template.

Description

The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or search[publish_date] parameter.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Nuclei templates
1

Proofs of concept

1

Catalogued exploits

ExploitDBWordPress Plugin Download Manager 2.9.93 - Cross-Site ScriptingExploitDB exploitby MgThuraMoeMyintNot analyzed1 file
ExploitDB
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Download Manager <2.9.94 - Cross-Site ScriptingCVSS 6.1

WordPress Download Manager plugin before 2.9.94 contains a cross-site scripting vulnerability via the category shortcode feature, as demonstrated by the orderby or search[publish_date] parameter.

Impact

Successful exploitation of this vulnerability could lead to the execution of arbitrary script code in the context of the affected website, potentially allowing an attacker to steal sensitive information or perform unauthorized actions.

Remediation

Update WordPress Download Manager plugin to version 2.9.94 or later to mitigate this vulnerability.

WeaknessesCWE-79
Authorsdaffainfo
Template tagscvecve2019packetstormwordpressxsswp-pluginwpdownloadmanagervuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:wpdownloadmanager:wordpress_download_manager:*:*:*:*:*:wordpress:*:*
https://www.cybersecurity-help.cz/vdb/SB2019041819 https://wordpress.org/plugins/download-manager/#developers https://nvd.nist.gov/vuln/detail/CVE-2019-15889 http://packetstormsecurity.com/files/154356/WordPress-Download-Manager-2.9.93-Cross-Site-Scripting.html https://plugins.trac.wordpress.org/changeset/2070388/download-manager

Source: ProjectDiscovery

References

8