PatchTheCVECVE-2021-24693: The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the "File Thumbnail" post meta befor
CVE-2021-24693 is a critical-severity flaw (CVSS 9.0) affecting simple download monitor. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the "File Thumbnail" post meta before outputting it in some pages, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks. Given the that XSS is triggered even when the Download is in a review state, contributor could make JavaScript code execute in a context of a reviewer such as admin and make them create a rogue admin acc
Why this priority
- Critical severity
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.0 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | Required |
| EPSS exploit chance | 1.3% (top 30%) |
| CISA exploited list | No |
| Weakness | CWE-79 |
| Published | 2021-11-08 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2021-24693?
simple download monitor: upgrade to 3.9.5. Exact commands for each OS are on this page.
Is CVE-2021-24693 being exploited?
CVE-2021-24693 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2021-24693 affect?
CVE-2021-24693 affects simple download monitor. Severity is critical (CVSS 9.0). The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the "File Thumbnail" post meta before outputting it in some pages, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting at
How urgent is CVE-2021-24693?
Priority 54/100. Critical severity; Public exploit reference
Software pages
Related CVEs
- CVE-2021-24698 MEDIUM 4.3 UPGRADE The Simple Download Monitor WordPress plugin before 3.9.6 allows users with a role as low as Contributor to re
- CVE-2021-24697 MEDIUM 6.1 UPGRADE The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the 1) sdm_active_tab GET parameter
- CVE-2021-24696 HIGH 8.8 UPGRADE The Simple Download Monitor WordPress plugin before 3.9.9 does not enforce nonce checks, which could allow att
- CVE-2021-24695 HIGH 7.5 UPGRADE The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not h
- CVE-2021-24694 MEDIUM 5.4 UPGRADE The Simple Download Monitor WordPress plugin before 3.9.11 could allow users with a role as low as Contributor