What’s Vulnerable › Vulnerabilities

CVE-2021-24773: WordPress Download Manager < 3.2.16 - Admin+ Stored Cross-Site Scripting

• Severity: medium (CVSS 4.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-11-01 · updated 2026-06-17
• Weakness: CWE-79

Description

The WordPress Download Manager WordPress plugin before 3.2.16 does not escape some of the Download settings when outputting them, allowing high privilege users to perform XSS attacks even when the unfiltered_html capability is disallowed

Affected products

• codename065 Download Manager: before 3.2.16 — fixed in 3.2.16

How to fix

Upgrade to a fixed version: codename065 Download Manager 3.2.16. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/aab2ddbb-7675-40fc-90ee-f5bfa8a5b995
• https://wpscan.com/vulnerability/aab2ddbb-7675-40fc-90ee-f5bfa8a5b995

Get alerted when CVE-2021-24773 or the next vulnerability affects your stack