CVE-2012-4768 – Download Monitor <= 3.3.5.8 - Reflected Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2012-4768

Cross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the dlsearch parameter to the default URI. Vulnerabilidad de XSS en el plugin Download Monitor anterior a 3.3.5.9 para WordPress permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro dlsearch en la URI por defecto. Wordpress Download Monitor version 3.3.5.7 suffers from a cross site scripting vulnerability. • https://www.exploit-db.com/exploits/37787 http://archives.neohapsis.com/archives/bugtraq/2012-09/0042.html http://osvdb.org/85319 http://packetstormsecurity.org/files/116408/wpdownloadmonitor3357-xss.txt http://secunia.com/advisories/50511 http://www.reactionpenetrationtesting.co.uk/wordpress-download-monitor-xss.html https://exchange.xforce.ibmcloud.com/vulnerabilities/78422 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •