https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-25T08:31:22.470188+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2021-24969 CVE-2021-24969 — Download Manager < 3.2.22 - Subscriber+ Stored Cross-Site Scripting 2026-10-25T08:31:22.471392+00:00

Affected: Unknown WordPress Download Manager

The WordPress Download Manager WordPress plugin before 3.2.22 does not sanitise and escape Template data before outputting it in various pages (such as admin dashboard and frontend). Due to the lack of authorisation and CSRF checks in the wpdm_save_template AJAX action, any authenticated users such as subscriber is able to call it and perform Cross-Site Scripting attacks