// For flags

CVE-2018-5213

Simple Download Monitor < 3.5.4 - Authenticated Stored Cross-Site Scripting

Severity Score

5.4
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

2
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload (aka Downloadable File) parameter in an edit action to wp-admin/post.php.

El plugin Simple Download Monitor en versiones anteriores a la 3.5.4 para WordPress tiene Cross-Site Scripting (XSS) mediante el parámetro sdm_upload (también conocido como Downloadable File) en una acción edit en wp-admin/post.php.

*Credits: d4wner
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
Single
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2018-01-02 CVE Published
  • 2018-01-04 CVE Reserved
  • 2023-05-08 EPSS Updated
  • 2024-08-05 CVE Updated
  • 2024-08-05 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Simple Download Monitor Project
Search vendor "Simple Download Monitor Project"
Simple Download Monitor
Search vendor "Simple Download Monitor Project" for product "Simple Download Monitor"
3.5.4
Search vendor "Simple Download Monitor Project" for product "Simple Download Monitor" and version "3.5.4"
wordpress
Affected