CVE-2021-24698: vulnerability in Simple Download Monitor
Simple Download Monitor < 3.9.6 - Arbitrary Thumbnails Removal
Published · Updated
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 0.7%
exploitation probability
0.7%top 49% of all CVEs
observed exploitation
nono source reports it
The Simple Download Monitor WordPress plugin before 3.9.6 allows users with a role as low as Contributor to remove thumbnails from downloads they do not own, even if they cannot normally edit the download.
Affected products
Unknown · Simple Download MonitorRelated CVEs — Simple Download Monitor
In the same product, most dangerous first.
CVE-2021-24695—Simple Download Monitor < 3.9.6 - Unauthenticated Log AccessEPSS 1.7%CVE-2021-24692—Simple Download Monitor < 3.9.5 - Contributor+ Arbitrary File Download via Path TraversalEPSS 1.4%CVE-2021-24693—Simple Download Monitor < 3.9.5 - Contributor+ Stored Cross-Site Scripting via File ThumbnailEPSS 1.3%CVE-2021-24697—Simple Download Monitor < 3.9.5 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2021-24696—Simple Download Monitor < 3.9.9 - Multiple CSRFEPSS 0.6%CVE-2021-24694—Simple Download Monitor < 3.9.11 - Contributor+ Stored Cross-Site Scripting via ShortcodesEPSS 0.6%