simple download monitor vulnerabilities and fixes

Recent CVEs affecting simple download monitor, with upgrade or downgrade steps. 11 tracked.

Also searched as: simpledownloadmonitor.

simple download monitor has 11 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 9. Most recent: 2022-03-14. Highest priority: CVE-2021-24695 (score 55/100).

• CVE-2021-24698 MEDIUM 4.3 UPGRADE The Simple Download Monitor WordPress plugin before 3.9.6 allows users with a role as low as Contributor to re
• CVE-2021-24697 MEDIUM 6.1 UPGRADE The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the 1) sdm_active_tab GET parameter
• CVE-2021-24696 HIGH 8.8 UPGRADE The Simple Download Monitor WordPress plugin before 3.9.9 does not enforce nonce checks, which could allow att
• CVE-2021-24695 HIGH 7.5 UPGRADE The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not h
• CVE-2021-24694 MEDIUM 5.4 UPGRADE The Simple Download Monitor WordPress plugin before 3.9.11 could allow users with a role as low as Contributor
• CVE-2021-24693 CRITICAL 9.0 UPGRADE The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the "File Thumbnail" post meta befor
• CVE-2021-24692 MEDIUM 6.5 UPGRADE The Simple Download Monitor WordPress plugin before 3.9.5 allows users with a role as low as Contributor to do
• CVE-2020-5651 HIGH 8.8 UPGRADE SQL injection vulnerability in Simple Download Monitor 3.8.8 and earlier allows remote attackers to execute ar
• CVE-2020-5650 MEDIUM 6.1 UPGRADE Cross-site scripting vulnerability in Simple Download Monitor 3.8.8 and earlier allows remote attackers to inj
• CVE-2018-5213 MEDIUM 5.4 DOWNGRADE The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload (aka Downloadable Fil
• CVE-2018-5212 MEDIUM 5.4 DOWNGRADE The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload_thumbnail (aka File T

FAQ

How do I fix simple download monitor vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is simple download monitor being exploited right now?

None of the tracked simple download monitor CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which simple download monitor CVE should I patch first?

CVE-2021-24695 currently ranks highest (55/100): The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not h.

RSS feed for simple download monitor · ← Back to latest CVEs