CVE-2019-15889: XSS
First published: Tue Sep 03 2019(Updated: )
The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or search[publish_date] parameter.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WordPress Download Manager | <2.9.94 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/154356/WordPress-Download-Manager-2.9.93-Cross-Site-Scripting.html
- https://packetstormsecurity.com/files/152511/WordPress-Download-Manager-2.9.92-Cross-Site-Scripting.html
- https://packetstormsecurity.com/files/152552/WordPress-Download-Manager-2.9.93-Cross-Site-Scripting.html
- https://plugins.trac.wordpress.org/changeset/2070388/download-manager
- https://wordpress.org/plugins/download-manager/#developers
- https://wpvulndb.com/vulnerabilities/9257
- https://www.cybersecurity-help.cz/vdb/SB2019041819
Frequently Asked Questions
What is the severity of CVE-2019-15889?
CVE-2019-15889 is classified as a medium severity vulnerability due to its potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2019-15889?
To fix CVE-2019-15889, update the WordPress Download Manager plugin to version 2.9.94 or later.
What is the impact of CVE-2019-15889?
The impact of CVE-2019-15889 allows an attacker to inject malicious scripts into web pages viewed by users.
Who is affected by CVE-2019-15889?
CVE-2019-15889 affects users of the WordPress Download Manager plugin versions prior to 2.9.94.
What type of vulnerability is CVE-2019-15889?
CVE-2019-15889 is a cross-site scripting (XSS) vulnerability that can be exploited through crafted shortcode parameters.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/remedy
- agent/author
- agent/last-modified-date
- agent/references
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/weakness
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/wpdownloadmanager
- canonical/wordpress download manager