CVE-2026-2383

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2383", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-11T22:02:29.167Z", "datePublished": "2026-02-27T08:24:19.262Z", "dateUpdated": "2026-04-08T16:53:28.783Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:53:28.783Z"}, "affected": [{"vendor": "mra13", "product": "Simple Download Monitor", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.0.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Simple Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom field in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Simple Download Monitor <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/556e41d1-2c98-4175-87ba-29689704c2f0?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/simple-download-monitor/tags/4.0.3/sdm-shortcodes.php#L543"}, {"url": "https://plugins.trac.wordpress.org/browser/simple-download-monitor/trunk/sdm-shortcodes.php#L543"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3464024%40simple-download-monitor%2Ftrunk&old=3430786%40simple-download-monitor%2Ftrunk&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "timeline": [{"time": "2026-02-26T19:24:24.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-27T16:40:22.691715Z", "id": "CVE-2026-2383", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T18:46:07.505Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2383", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-27T16:40:22.691715Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T18:46:03.428Z"}}], "cna": {"title": "Simple Download Monitor <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "mra13", "product": "Simple Download Monitor", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "4.0.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-26T19:24:24.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/556e41d1-2c98-4175-87ba-29689704c2f0?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/simple-download-monitor/tags/4.0.3/sdm-shortcodes.php#L543"}, {"url": "https://plugins.trac.wordpress.org/browser/simple-download-monitor/trunk/sdm-shortcodes.php#L543"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3464024%40simple-download-monitor%2Ftrunk&old=3430786%40simple-download-monitor%2Ftrunk&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Simple Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom field in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-02-27T08:24:19.262Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2383", "state": "PUBLISHED", "dateUpdated": "2026-03-06T18:46:07.505Z", "dateReserved": "2026-02-11T22:02:29.167Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-27T08:24:19.262Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Simple Download Monitor", "vendor": "mra13", "versions": [{"lessThanOrEqual": "4.0.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Simple Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom field in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Simple Download Monitor para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s de un campo personalizado en todas las versiones hasta la 4.0.5, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes autenticados, con acceso de nivel Colaborador o superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2026-2383", "lastModified": "2026-06-17T10:30:52.680", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2383", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-27T16:40:22.691715Z", "version": "2.0.3"}}]}, "published": "2026-02-27T09:16:17.480", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/simple-download-monitor/tags/4.0.3/sdm-shortcodes.php#L543"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/simple-download-monitor/trunk/sdm-shortcodes.php#L543"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3464024%40simple-download-monitor%2Ftrunk&old=3430786%40simple-download-monitor%2Ftrunk&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/556e41d1-2c98-4175-87ba-29689704c2f0?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.0.5]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Simple Download Monitor", "source": "cna", "vendor": "mra13"}, "product": "simple_download_monitor", "vendor": "mra13"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T23:51:20.844660+00:00", "value": {"mitigation_remediation": ["Upgrade Simple Download Monitor to the latest available version, ensuring the fix is applied.", "If an upgrade cannot be performed immediately, reduce the privileges of existing Contributor users or revoke the ability to edit download items altogether.", "Implement a web application firewall or set up content filtering rules to block the execution of script tags in user\u2011provided content, or manually sanitize the output to remove any injected scripts."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "All WordPress sites that have installed Simple Download Monitor version 4.0.5 or earlier are affected. The vulnerability exists in every installation of the plugin within that version range, regardless of other plugins or theme configurations, and requires only that the authenticated user be able to create or edit download items.", "description_and_impact": "The Simple Download Monitor WordPress plugin is vulnerable to stored cross\u2011site scripting via its custom field, allowing an authenticated user with Contributor or higher privileges to embed arbitrary JavaScript that executes in the browser of any visitor who views an affected page. This client\u2011side injection flaw (CWE\u201179) can lead to cookie theft, session hijacking, defacement or the execution of further malicious payloads without the victim\u2019s knowledge.", "risk_and_exploitability": "The flaw carries a CVSS score of 6.4, placing it in the medium severity range, and an EPSS score below 1\u202f%, indicating a low probability of exploitation at present. It is not listed in the CISA KEV catalog. Attackers must be authenticated and hold at least Contributor access, making the vector an authentic one. Exploitation requires the creation or editing of a download item and the insertion of malicious JavaScript into its custom field, which is then stored and rendered whenever the page is accessed by any user."}}}}, "created": "2026-02-27T16:06:01.345273+00:00", "updated": "2026-04-16T00:00:14.136834+00:00", "vendors": ["mra13", "mra13$PRODUCT$simple_download_monitor", "wordpress", "wordpress$PRODUCT$wordpress"]}