漏洞描述
WordPress Download Manager plugin before 2.9.94 contains a cross-site scripting vulnerability via the category shortcode feature, as demonstrated by the orderby or search[publish_date] parameter.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
www.cybersecurity-help.czhttps://www.cybersecurity-help.cz/vdb/SB2019041819↗wordpress.orghttps://wordpress.org/plugins/download-manager/#developers↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2019-15889↗packetstormsecurity.comhttp://packetstormsecurity.com/files/154356/WordPress-Download-Manager-2.9.93-Cross-Site-Scripting.html↗plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/changeset/2070388/download-manager↗