WordPress Download Manager 3.2.43 Cross Site Scripting

WordPress Download Manager plugin versions 3.2.43 and below suffer from a cross site scripting vulnerability.


SHA-256 | c5e010f3009e39b7db11c52ad43c84317ef6588fbfb45a6713c6d0812c0cf403

Download
Exploit Title: Download Manager Cross-Site Scripting
Date: 2022-06-16
Exploit Author :  Andrea Bocchetti
Vendor Homepage : https://wordpress.org/plugins/download-manager/
Version :  <= 3.2.43
Tested on: windows
CVE :  CVE-2022-2101

######## Description ########
# 1-) Login in the plugin page
# 2-) add the xss payload in the field "Insert URL"
# 3-) Click on the link , the JS code will be interpreted.

Source: packetstormsecurity.com
Related Posts