CVE-2023-4838: XSS
The Simple Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 1.6 due to insufficient input sanitization and output escaping on user supplied attributes like 'before' and 'after'. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this WordPress plugin vulnerability?
The vulnerability ID for this WordPress plugin vulnerability is CVE-2023-4838.
What is the title of this vulnerability?
The title of this vulnerability is 'The Simple Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th…'.
What is the severity level of CVE-2023-4838?
The severity level of CVE-2023-4838 is medium.
How does CVE-2023-4838 affect the Simple Download Counter plugin for WordPress?
CVE-2023-4838 affects the Simple Download Counter plugin for WordPress in versions up to, and including, 1.6.
How can I fix the vulnerability in the Simple Download Counter plugin for WordPress?
To fix the vulnerability in the Simple Download Counter plugin for WordPress, you should update to the latest version of the plugin.