CVSS: 6.4EPSS: %CPEs: 1EXPL: 0CVE-2024-51875 – MDC YouTube Downloader <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2024-51875
The MDC YouTube Downloader plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 2%CPEs: 1EXPL: 2CVE-2015-5469 – MDC YouTube Downloader < 2.1.1 - Directory Traversal
https://notcve.org/view.php?id=CVE-2015-5469
Absolute path traversal vulnerability in the MDC YouTube Downloader plugin 2.1.0 for WordPress allows remote attackers to read arbitrary files via a full pathname in the file parameter to includes/download.php. Salto de directorio absoluto en el plugin MDC YouTube Downloader para WordPress, versión 2.1.0, que permitiría a atacantes remotos leer ficheros arbitrarios a través de rutas de archivos completas en el parámetro file de includes/download.php. • http://www.openwall.com/lists/oss-security/2015/07/07/1 http://www.openwall.com/lists/oss-security/2015/07/10/5 http://www.vapid.dhs.org/advisory.php?v=133 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •