Threat Entry Updated 2024-11-21

CVE-2024-3230 - Download Attachments Plugin

The Download Attachments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'download-attachments' shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Download Attachments

CVE-2024-3230

MEDIUM CVSS 6.4 2024-06-04

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2023-0076 - Download Attachments Plugin

The Download Attachments WordPress plugin before 1.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

PLUGIN Download Attachments

CVE-2023-0076

MEDIUM CVSS 5.4 2023-03-06

Risk Score

Open Full Technical Breakdown