CVE-2021-24969 Download Manager < 3.2.22 - Subscriber+ Stored Cross-Site Scripting

What is CVE-2021-24969?

CVE-2021-24969 is a medium-severity cross-site scripting vulnerability in Unknown WordPress Download Manager, published on 27 Dec 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

The WordPress Download Manager WordPress plugin before 3.2.22 does not sanitise and escape Template data before outputting it in various pages (such as admin dashboard and frontend). Due to the lack of authorisation and CSRF checks in the wpdm_save_template AJAX action, any authenticated users such as subscriber is able to call it and perform Cross-Site Scripting attacks

Weakness: CWE-79

Which versions are affected by CVE-2021-24969?

It affects 1 product.

Products include W3eden Download Manager.

How do I fix CVE-2021-24969?

No fix has been published for CVE-2021-24969 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2021-24969 being exploited?

There is no known exploitation of CVE-2021-24969 in the wild and no public exploit code.

Other vulnerabilities in Unknown WordPress Download Manager

• CVE-2022-2436 Download Manager <= 3.2.49 - Authenticated (Contributor+) PHAR Deserialization High 8.8
• CVE-2021-25069 WordPress Download Manager < 3.2.34 - Authenticated SQL Injection to Reflected XSS High 8.8
• CVE-2014-9260 Missing authorization in n/a High 8.8
• CVE-2022-2431 Download Manager <= 3.2.50 - Authenticated (Contributor+) Arbitrary File Deletion High 8.1
• CVE-2024-2098 Download Manager <= 3.2.89 - Improper Authorization via protectMediaLibrary High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3366-5rqh-74c5.