CVE-2017-2216

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Cross-site scripting vulnerability in WordPress Download Manager prior to version 2.9.50 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
W3 Eden, Inc.	WordPress Download Manager	prior to version 2.9.50

References

https://jvn.jp/en/jp/JVN79738260/index.htmlThird Party Advisory
https://plugins.trac.wordpress.org/changeset/1650075/Issue Tracking, Patch, Vendor Advisory
https://wordpress.org/plugins/download-manager/#developersPatch, Release Notes, Vendor Advisory
https://jvn.jp/en/jp/JVN79738260/index.htmlThird Party Advisory
https://plugins.trac.wordpress.org/changeset/1650075/Issue Tracking, Patch, Vendor Advisory
https://wordpress.org/plugins/download-manager/#developersPatch, Release Notes, Vendor Advisory

Timeline

Published: Jul 7, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-22176.1Open redirect vulnerability in WordPress Download Manager prior to version 2.9.51 allows remote attackers to redirect users to arbitrary web CVE-2017-22187.8Untrusted search path vulnerability in Installer of QuickTime for Windows allows an attacker to gain privileges via a Trojan horse DLL in an CVE-2017-22197.8Untrusted search path vulnerability in the [Simeji for Windows] installer (simeji.exe) allows an attacker to gain privileges via a Trojan ho CVE-2017-22207.8Untrusted search path vulnerability in Installer of CASL II simulator (self-extract format) allows an attacker to gain privileges via a Troj CVE-2017-22217.8Untrusted search path vulnerability in Installer of Baidu IME Ver3.6.1.6 and earlier allows an attacker to gain privileges via a Trojan hors CVE-2017-22226.1Cross-site scripting vulnerability in WP-Members prior to version 3.1.8 allows remote attackers to inject arbitrary web script or HTML via u CVE-2017-22238.8Cross-site request forgery (CSRF) vulnerability in TS-WPTCAM, TS-PTCAM, TS-PTCAM/POE, TS-WLC2, TS-WLCE, TS-WRLC firmware version 1.19 and ea CVE-2017-22246.1Cross-site scripting vulnerability in Event Calendar WD prior to version 1.0.94 allows remote attackers to inject arbitrary web script or HT CVE-2017-22259.8Untrusted search path vulnerability in EbidSettingChecker.exe (version 1.0.0.0) allows an attacker to gain privileges via a Trojan horse DLL CVE-2017-22267.8Untrusted search path vulnerability in Setup file of advance preparation for e-Tax software (WEB version) (1.17.1) and earlier allows an att CVE-2017-22277.8Untrusted search path vulnerability in The installer of Charamin OMP Version 1.1.7.4 and earlier, Version 1.2.0.0 Beta and earlier allows an CVE-2017-22287.8Untrusted search path vulnerability in Teikihoukokusho Sakuseishien Tool v4.0 allows an attacker to gain privileges via a Trojan horse DLL i