- This topic has 11 replies, 4 voices, and was last updated 30 minutes ago by
.
Hello,
are you working on fixing the security risk?
Thank you!
Hello Hans Mueller,
Hope you are well. Can you please kindly share the issue related link or details of the issue thus I can forward it to our team? Please kindly check.
Thank you
Hello, Nayeem,
the issue is that WordFence highly recommends to remove the plugin until fixed
See warning here:
Can you share the report or the texts? The image link is broken.
Thank you
I have updated the link:
The language is not english for understanding or sharing. Please kindly check.
Thank you
Please kindly share the english message of the report, thus I can forward.
Thank you aagain.
Okay, since I get theses warnings in german, maybe this helps:
https://www.wordfence.com/central/findings/a08b9872-6abf-42c2-a21e-5adb98040d35
I am asking about the free version of DL Manager, not V 7.5.9 Premium
Hello,
The link needs to login in the Wordfence system.
This is the text of the message received from Wordfence (again, for the Pro version, but probably valid for the free too):
Download Manager <= 7.5.9 – Unauthenticated Stored Cross-Site Scripting via Registration Form (WP_Error-as-ID) via Spotlight Template [author_name
Wordfence Intelligence > Vulnerability Database > Download Manager <= 7.5.9 – Unauthenticated Stored Cross-Site Scripting via Registration Form (WP_Error-as-ID) via Spotlight Template [author_name]
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpdm_reg[first_name], wpdm_reg[last_name], wpdm_reg[user_login]’ parameter in all versions up to, and including, 7.5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the site to have “Anyone can register” enabled, the plugin’s [wpdm_reg_form] shortcode published on a public page, and at least one package authored by user ID 1 rendered with the Spotlight link template.
Hello Hans Mueller, Is your issue the same as Max Belloni’s? Please check and let me know.
Thank you and regards.
There is no apparent issue. I just followed the instructions of WordFence: De-install and delete the plugin because it is unsafe …
It is a client-site and I do not want to take risks. Maybe you contact WordFence for details?
Thank you.
PS: this here is the warning for the free version:
https://www.wordfence.com/central/findings/a08b9872-6abf-42c2-a21e-5adb98040d35
Maybe you must register, but it’s free 😉
Good Morning, I have also had notifications for security issues with this plugin.
‘Howdy!
WordPress has a built-in feature that detects when a plugin or theme causes a fatal error on your site, and notifies you with this automated email.
In this case, WordPress caught an error with one of your plugins, WP Activity Log.’
‘The Download Manager plugin for WordPress has a security issue that affects all versions up to 7.5.9. This problem allows attackers to insert harmful scripts into the site, which can run when users visit certain pages. For this issue to happen, the following must be true: the site must allow anyone to register, the plugin’s registration form must be publicly available, and there must be at least one package created by the main user (user ID 1) displayed in a specific layout.’
You must be logged in to reply to this topic.