PatchTheCVECVE-2021-24697: The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the 1) sdm_active_tab GET parameter
CVE-2021-24697 is a medium-severity flaw (CVSS 6.1) affecting simple download monitor. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the 1) sdm_active_tab GET parameter and 2) sdm_stats_start_date/sdm_stats_end_date POST parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
Why this priority
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.1 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 0.8% (top 43%) |
| CISA exploited list | No |
| Weakness | CWE-79 |
| Published | 2021-11-08 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2021-24697?
simple download monitor: upgrade to 3.9.5. Exact commands for each OS are on this page.
Is CVE-2021-24697 being exploited?
CVE-2021-24697 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2021-24697 affect?
CVE-2021-24697 affects simple download monitor. Severity is medium (CVSS 6.1). The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the 1) sdm_active_tab GET parameter and 2) sdm_stats_start_date/sdm_stats_end_date POST parameters before outputting them back in attributes, leading to Reflected Cro
How urgent is CVE-2021-24697?
Priority 41/100. Public exploit reference
Software pages
Related CVEs
- CVE-2021-24698 MEDIUM 4.3 UPGRADE The Simple Download Monitor WordPress plugin before 3.9.6 allows users with a role as low as Contributor to re
- CVE-2021-24696 HIGH 8.8 UPGRADE The Simple Download Monitor WordPress plugin before 3.9.9 does not enforce nonce checks, which could allow att
- CVE-2021-24695 HIGH 7.5 UPGRADE The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not h
- CVE-2021-24694 MEDIUM 5.4 UPGRADE The Simple Download Monitor WordPress plugin before 3.9.11 could allow users with a role as low as Contributor
- CVE-2021-24693 CRITICAL 9.0 UPGRADE The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the "File Thumbnail" post meta befor