CVE-2022-2101 — Cross-site Scripting in Download Manager

CWE-79 — Cross-site ScriptingCWE-663 — Use of a Non-reentrant Function in a Concurrent Context4 documents4 sources
Severity
5.4MEDIUMNVD
CNA6.4
EPSS
0.3%
top 45.54%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Codename065 Download ManagerW3eden Download Manager
Timeline
PublishedJul 18
Latest updateFeb 26

Description

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `file[files][]` parameter in versions up to, and including, 3.2.46 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor level permissions and above to inject arbitrary web scripts on the file's page that will execute whenever an administrator accesses the editor area for the injected file page.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages2 packages

Patches

Patch: plugins.trac.wordpress.org ↗Patch: plugins.trac.wordpress.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-gjv4-fmq6-6x2x: The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `file[files][]` parameter in versions up to, and includ↗2022-07-19
▶
CVEList
Download Manager <= 3.2.46 - Contributor+ Cross-Site Scripting↗2022-07-18
▶

📋Vendor Advisories

1
Red Hat
kernel: ice: fix 'scheduling while atomic' on aux critical err interrupt↗2025-02-26
▶
CVE-2022-2101 — Cross-site Scripting | cvebase