CVE-2025-7387

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-7387", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-07-09T10:48:40.617Z", "datePublished": "2025-07-10T05:24:12.316Z", "dateUpdated": "2026-04-08T17:19:06.976Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:19:06.976Z"}, "affected": [{"vendor": "lanacodes", "product": "Lana Downloads Manager", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.10.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Lana Downloads Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the endpoint parameters in versions up to, and including, 1.10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with administrator-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Lana Downloads Manager <= 1.10.0 - Authenticated (Administrator+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/be0db9ff-dc95-4c92-8dc4-472c5df9c0dd?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/lana-downloads-manager/tags/1.10.0/lana-downloads-manager.php#L763"}, {"url": "https://plugins.trac.wordpress.org/changeset/3324923/lana-downloads-manager"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 5.5, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Istv\u00e1n M\u00e1rton"}], "timeline": [{"time": "2025-07-09T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-07-09T00:00:00.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-07-09T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-10T13:10:37.240657Z", "id": "CVE-2025-7387", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-10T13:10:45.344Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-7387", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-10T13:10:37.240657Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-10T13:10:40.468Z"}}], "cna": {"title": "Lana Downloads Manager <= 1.10.0 - Authenticated (Administrator+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Istv\u00e1n M\u00e1rton"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "lanacodes", "product": "Lana Downloads Manager", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.10.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-07-09T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-07-09T00:00:00.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-07-09T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/be0db9ff-dc95-4c92-8dc4-472c5df9c0dd?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/lana-downloads-manager/tags/1.10.0/lana-downloads-manager.php#L763"}, {"url": "https://plugins.trac.wordpress.org/changeset/3324923/lana-downloads-manager"}], "descriptions": [{"lang": "en", "value": "The Lana Downloads Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the endpoint parameters in versions up to, and including, 1.10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with administrator-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:19:06.976Z"}}}, "cveMetadata": {"cveId": "CVE-2025-7387", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:19:06.976Z", "dateReserved": "2025-07-09T10:48:40.617Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-07-10T05:24:12.316Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Lana Downloads Manager", "vendor": "lanacodes", "versions": [{"lessThanOrEqual": "1.10.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Lana Downloads Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the endpoint parameters in versions up to, and including, 1.10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with administrator-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento Lana Downloads Manager para WordPress es vulnerable a Cross-Site Scripting almacenado a trav\u00e9s de los par\u00e1metros del endpoint en versiones hasta la 1.10.0 (incluida), debido a una depuraci\u00f3n de entrada insuficiente y al escape de salida en los atributos proporcionados por el usuario. Esto permite a atacantes autenticados con permisos de administrador o superiores inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada."}], "id": "CVE-2025-7387", "lastModified": "2026-06-17T10:04:49.497", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-7387", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-07-10T13:10:37.240657Z", "version": "2.0.3"}}]}, "published": "2025-07-10T06:15:22.503", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/lana-downloads-manager/tags/1.10.0/lana-downloads-manager.php#L763"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3324923/lana-downloads-manager"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/be0db9ff-dc95-4c92-8dc4-472c5df9c0dd?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T20:22:41.227520+00:00", "value": {"mitigation_remediation": ["Upgrade Lana Downloads Manager to the latest version (newer than 1.10.0).", "Restrict administrator and superuser accounts to essential users only, and consider disabling the plugin if it is not needed.", "Implement a strict Content Security Policy to mitigate any residual XSS risk."], "summary": {"action": "Patch Update", "impact": "Stored XSS to administrators."}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Lana Downloads Manager plugin version 1.10.0 and all earlier releases. Administrators and users with higher privileges on affected WordPress sites running this plugin are at risk.", "description_and_impact": "The Lana Downloads Manager plugin for WordPress is vulnerable to stored cross\u2011site scripting because endpoint parameters are not properly sanitized or escaped. This flaw allows an authenticated attacker with administrator\u2011level or higher privileges to inject arbitrary scripts that will execute for any user who accesses a page containing the injected content. The vulnerability is classified as CWE\u201179.", "risk_and_exploitability": "The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% shows a low likelihood of exploitation at the time of this analysis. The flaw is not listed in the CISA KEV catalog. Exploitation requires login as an administrator or higher; the attacker can then craft a malicious request to the vulnerable endpoint to store the script. Once stored, any visitor to the affected page will execute the injected code in their browser."}}}}, "created": "2025-07-13T22:31:23.455155+00:00", "updated": "2026-04-20T20:30:16.069553+00:00", "vendors": ["lana", "lana$PRODUCT$lana_downloads_manager", "wordpress", "wordpress$PRODUCT$wordpress"]}