The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the "File Thumbnail" post meta before outputting it in some pages, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks. Given the that XSS is triggered even when the Download is in a review state, contributor could make JavaScript code execute in a context of a reviewer such as admin and make them create a rogue admin account, or install a malicious plugin
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Simple Download Monitor Plugin | — | Update simple-download-monitor plugin to version 3.9.5, or a newer patched version | May 15, 2025 | Oct 5, 2021 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub