CVE-2017-18032: XSS
Published Jan 16, 2018
·Updated
The download-manager plugin before 2.9.52 for WordPress has XSS via the id parameter in a wpdmgeneratepassword action to wp-admin/admin-ajax.php.
Affected Software
2 affected components
Wpdownloadmanager Wordpress Download Manager Wordpress<2.9.52
W3eden Download Manager Wordpress<2.9.52
Event History
Jan 16, 2018
CVE Published
via MITRE·09:00 AM
Data Sourced
via MITRE·09:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-18032?
CVE-2017-18032 has a CVSS score indicating a medium severity due to its XSS vulnerability.
2
How do I fix CVE-2017-18032?
To fix CVE-2017-18032, update the WordPress Download Manager plugin to version 2.9.52 or higher.
3
What is the impact of CVE-2017-18032?
CVE-2017-18032 allows attackers to execute arbitrary JavaScript code on affected sites via a cross-site scripting (XSS) attack.
4
Which versions of the WordPress Download Manager are affected by CVE-2017-18032?
CVE-2017-18032 affects all versions of the WordPress Download Manager plugin before 2.9.52.
5
Is CVE-2017-18032 specific to a certain content management system?
Yes, CVE-2017-18032 specifically affects the WordPress content management system.